A logic error in the Linux kernel’s multithreaded resulting in a warning when an MPTCP endpoint is marked as both signal and subflow but no subflows are actually created. This mismatch can lead to incorrect internal bookkeeping and potentially unstable MPTCP connections, though the path does not expose code execution or privilege escalation. The underlying weakness is an internal consistency check failure, captured by CWE-911 in the advisory.

Linux kernel binaries, specifically builds that include the MPTCP subsystem. The issue was reproduced against a 6.19.x kernel image; other recent stable kernels that compile the same module may be affected if they have not incorporated the patch. Impacted systems are those running recent Linux distributions with the default MPTCP kernel networking stack enabled.

The CVSS score of 5.5 classifies the weakness as moderate severity. The EPSS score is below 1%, indicating a low likelihood of exploitation. CISA has not listed the flaw in its KEV catalog, and no public exploit is known. Attackers would need local or privileged access to trigger the warning conditions, and there is no demonstrated remote code execution vector. The primary risk is system instability and potential loss of connectivity for applications relying on MPTCP rather than security breach.