The vulnerability arises from a race condition in the Linux kernel’s mptcp_pm_add_timer helper, which is executed as a timer callback in softirq context without acquiring the socket lock via bh_lock_sock(). The resulting concurrent modification of socket data structures can lead to data corruption, instability, or denial of service. This flaw is a data‑race weakness, classified as CWE‑821. Based on the documentation, it is inferred that an attacker could trigger the race by generating rapid socket activity, though no confirmed exploitation is reported.

The affected systems are Linux kernel deployments that do not include the patch adding the bh_lock_sock() guard to the MPTCP logic. All kernel versions prior to the commit that introduced this protection, regardless of vendor specialization, are potentially vulnerable.

The CVSS score of 9.8 and the EPSS score of < 1% indicate high severity with low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector is local or remote with sufficient network activity to trigger the race in the timer callback. Attackers could attempt to cause rapid MPTCP socket operations to induce the race, potentially leading to system instability or denial of service. No successful exploitation has been documented, but the high severity means the flaw should be addressed promptly.