In the Linux kernel’s Multi‑Path TCP (MPTCP) userspace PM component, a race condition in the function that retrieves a local address identifier can read memory after the associated object has been freed. The vulnerability is triggered when an entry is looked up while holding a spinlock, released, and then its id is accessed; a concurrent delete operation may free the entry during the brief window, yielding a use‑after‑free. The KASAN trace confirms that the race is real. If an attacker can repeatedly trigger the race, the kernel could crash or potentially execute arbitrary code, although the window is narrow and the example reproductions were local.

The flaw is present in any Linux kernel build that includes the MPTCP userspace PM implementation. No specific kernel version numbers are listed in the advisory; the vulnerability applies to all supported kernels until the patch that copies the id while holding the lock is applied.

The CVSS score is 7.0, indicating moderate severity. The EPSS score indicates a very low exploitation probability (<1%). The flaw is not listed in the CISA KEV catalog. The race requires overlapping MPTCP join and subflow‑destroy operations; the need for specific traffic patterns or privileged local execution reduces the likelihood of successful exploitation. Immediate patching is recommended.