The Linux kernel mptcp_token_join_cookie_init_state() function restores several fields from a saved cookie entry when reconstructing the request socket for an MP_JOIN 4th-ACK under SYN cookies, but it omits restoring the local_id field. Consequently, subflow_ulp_clone() reads an uninitialized local_id from a non-zeroed request-sock slab, which may contain stale data from a previously freed request socket. An off-path attacker can influence this stale value by sending concurrent MP_JOIN SYN packets, causing corruption in the path manager's id-based subflow bookkeeping.

The vulnerability can lead to corruption of the multipath TCP path manager's subflow bookkeeping due to use of stale memory values for local_id. This may affect the integrity of subflow management within the connection. There is no indication of remote code execution or denial of service directly from the description. No known exploits in the wild have been reported.

A fix has been implemented that restores the local_id field from the cookie entry during MP_JOIN reconstruction, aligning it with the restoration of other fields. Users should apply the official Linux kernel patch that addresses this issue once available. Patch status is not explicitly confirmed in the provided data; verify with the vendor advisory for current remediation guidance.