In the Linux kernel’s Multi‑Path TCP (MPTCP) userspace PM component, a race condition in the function that retrieves a local address identifier can read memory after the associated object has been freed. The vulnerability is triggered when an entry is looked up while holding a spinlock, released, and then its id is accessed; a concurrent delete operation may free the entry during the brief window, yielding a use‑after‑free. The KASAN trace confirms that the race is real. If an attacker can repeatedly trigger the race, the kernel could crash or potentially execute arbitrary code, although the window is narrow and the example reproductions were local.

The flaw is present in any Linux kernel build that includes the MPTCP userspace PM implementation. No specific kernel version numbers are listed in the advisory; the vulnerability applies to all supported kernels until the patch that copies the id while holding the lock is applied.

The CVSS score is not supplied, but a kernel‑level use‑after‑free is normally treated as high severity. Because the race is narrow and requires overlapping MPTCP join and subflow destroy operations, the likelihood of exploitation is uncertain. EPSS is not available and the flaw is not yet catalogued in the CISA KEV list. An attacker would need to orchestrate specific MPTCP traffic or otherwise exercise the race condition in a privileged or local context, so immediate patching is recommended.