A fault in Multicast TCP (MPTCP) initialization causes the TCPv6 slab cache pointer to remain null. When IPv6 subflow child sockets are allocated via kmalloc instead of the intended TCPv6 slab cache, the memory is not protected by SLAB_TYPESAFE_BY_RCU. If such sockets are freed while an RCU read‑side critical section is in progress, concurrent __inet_lookup_established hash table lookups can access freed memory, resulting in a slab‑use‑after‑free. This memory corruption (CWE‑416) can allow an attacker to trigger arbitrary kernel code execution or a denial‑of‑service condition if the fault occurs in a privileged context.

The flaw exists in Linux kernel releases 5.12 and all 7.0 release candidates up to rc7. Systems that run these kernels with MPTCP enabled and that establish IPv6 subflows are vulnerable. The fix was applied before the stable 7.0 rc7 release, so kernels derived from that branch after the corresponding commit include the remediation.

With a CVSS score of 9.8 it is classified as Critical; the EPSS score of less than 1% indicates a low probability of active exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers would likely need to trigger concurrent IPv6 subflow operations while a user space process holds an RCU read lock, a scenario that could be achieved by a local or privileged user that can open sockets. The risk is primarily local, but any compromised process could affect the host or connected network services.