The bug occurs when an MPTCP socket receives data with both MSG_PEEK and MSG_WAITALL flags enabled. The code path leaves the socket buffer (skb) in the receive queue, causing the kernel’s waiting routine sk_wait_data() to repeatedly find data and never yield to the scheduler. This leads to an infinite busy‑loop that manifests as a soft CPU lockup lasting minutes, consuming the core and degrading system responsiveness or triggering a watchdog reboot.

Any Linux kernel build that contains the original mptcp_recvmsg() implementation is vulnerable until the patch that tracks the last peeked skb is applied. The vulnerability is present in all mainstream releases before the commit 58b58b9, regardless of distribution, because the CNA lists only "Linux:Linux" and the affected‑version information is not specified. Administrators should verify if their kernel version precedes the patch and plan an upgrade accordingly.

The CVSS score of 7.0 indicates moderate–high severity, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, so no public exploitation has been reported. Based on the description, the likely attack vector is a local or remote user‑space program that invokes recv() with MSG_PEEK | MSG_WAITALL on an MPTCP socket; no kernel privilege is required. An attacker can trigger a soft lockup that stalls the affected core, leading to service disruption or a forced reboot if a watchdog monitors the core.