An issue in the Linux kernel’s Multipath TCP implementation caused the reference count for sockets used in ADD_ADDR retransmissions to be decreased incorrectly, which can allow sockets to remain allocated indefinitely. The resulting memory leak can grow kernel memory consumption until the system exhausts available resources, potentially leading to a denial‑of‑service condition if the leak is pronounced. The vulnerability is a flaw in resource management, directly impacting kernel stability and availability.

The flaw exists in the Linux kernel’s MPTCP subsystem and affects any kernel version prior to the commit that corrected the reference count handling. No specific kernel release is listed, so all affected kernels before the patch are at risk. The vulnerability is present on all Linux systems that have MPTCP enabled and have not been updated to the fixed version.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The CVSS score is not provided, but the kernel level nature of the flaw and its ability to leak memory make the risk moderate to high. An attacker would need the ability to send crafted or retransmitted MPTCP ADD_ADDR packets to the target, which is likely limited to local or network positions that can reach the kernel. Because the exploit requires repeated retransmissions, it is considered unlikely to be widely abused, yet the impact if successful would be significant.