A time‑of‑check/time‑of‑use race exists in the Linux kernel’s MPTCP protocol when advertising the receive window. The race is caused by the output path accessing the ACK sequence and the data acknowledgment fields without proper locking, leading the kernel to compute different values for the same packet’s advertised window. This inconsistency may confuse the remote peer about how much data it can send, possibly causing excessive retransmissions or stalled communication. The potential impact is therefore a degradation of MPTCP performance or intermittent connectivity failures.

Any Linux system running a kernel that still contains the unpatched MPTCP receive‑window code is vulnerable. No specific release numbers are indicated, so all kernel versions prior to the inclusion of the fix found in the linked patches are affected.

The CVSS score of 8.2 indicates high severity. However, the EPSS score of less than 1% suggests that exploitation is expected to be rare or technically difficult. The vulnerability is not listed in the CISA KEV catalog, implying no widespread exploitation is known. Attackers would have to establish an active MPTCP session and precisely time packets to trigger the race, which makes the path complex and limits overall risk despite the high severity.