The vulnerability is a race condition in the Multi‑Path TCP (MPTCP) implementation of the Linux kernel. Out‑of‑order data is incorrectly counted in mptcp_rcvbuf_grow(), leading to a divide‑by‑zero error that triggers a kernel Oops and results in a system crash. This flaw does not give an attacker arbitrary code execution, but it can cause a denial‑of‑service if an attacker can force obsolete accounting by sending crafted MPTCP packets. The weakness is an arithmetic error and a race condition (CWE‑369, CWE‑362).

The defect exists in the Linux kernel on all vendors that ship the upstream code with MPTCP support. Any system running the kernel before the fix and with MPTCP enabled is vulnerable. No specific version range is provided, so all such kernels are assumed affected until a kernel containing the patch is deployed.

The CVSS score is not available, and the EPSS score is not provided, so the precise likelihood of exploitation remains unknown. The issue is not listed in the CISA KEV catalog, indicating no confirmed exploitation in the wild. Although an attacker would need to orchestrate multiple MPTCP subflows and send out‑of‑order packets in a precise timing window to hit the race, the scenario is theoretically possible but unlikely to be actively abused.