The vulnerability resides in the Linux kernel’s Multipath TCP handling of retransmitted ADD_ADDR messages. When a retransmission occurs, the socket structure is placed on a retry timer and released only at the timer’s completion. If this socket is the last reference, the code incorrectly releases it, leading the kernel to wait indefinitely for a timer that has already finished. This deadlock can cause the system or affected process to hang, preventing further network communication and potentially exhausting resources. The primary consequence is a denial of service that could be triggered during normal MPTCP operation.

All Linux kernel implementations (Linux:Linux) are affected, as the issue is observed in the core kernel code. No specific version ranges are listed; any kernel build containing the buggy code path is susceptible.

The bug has an EPSS score of less than 1%, and it is not listed in the CISA KEV catalog. The CVSS score of 5.5 indicates a moderate level of severity. Because the flaw involves kernel memory management and timer handling, exploitation requires the ability to trigger a retransmission of an ADD_ADDR packet and to hold the last reference to the socket. This likely demands local privilege escalation or the execution of privileged code on the host. The attack vector is inferred to be a local kernel exploit rather than an externally reachable network service, given the internal nature of the fault.