The vulnerability involves a race condition in the Linux kernel’s mptcp_pm_add_timer helper, which runs as a timer callback in softirq context without acquiring the socket lock. This oversight can allow concurrent modification of socket data structures, leading to undefined behaviour that could manifest as denial of service or unexpected privilege escalation. The issued fix requires holding the socket lock via bh_lock_sock() before making changes, thus eliminating the race.

Affected systems are Linux kernel deployments that lack the recent patch adding the bh_lock_sock() guard to the MPTCP timer logic. The vendor is Linux, but no specific version ranges or CPE version details are disclosed in the CVE data.

The CVSS and EPSS metrics are not provided, and the KEV status is listed as "not listed in KEV", so a quantified risk assessment is unavailable. Nevertheless, data‑race bugs in kernel code are regarded as serious because they can potentially allow privilege escalation or system instability. The most likely attack vector would involve local or privileged access that triggers the MPTCP timer routine, but no autonomous exploitation has been documented. System administrators should check whether their kernel builds include the patch and evaluate whether they expose the system to untrusted MPTCP traffic.