The flaw is in the Multi‑Protocol Transport Control Protocol (MPTCP) path of the Linux kernel. During subflow teardown, the backlog cleanup of socket buffers was performed without holding the required data lock, causing a race condition. This race can leave a socket buffer pointing at a socket that has already been freed, leading to a use‑after‑free when the backlog is eventually purged. The weakness is a classic use‑after‑free (CWE‑416).

Any Linux system that runs a kernel containing the vulnerable MPTCP implementation and has MPTCP enabled is potentially affected. The patch belongs to commit 625fc6060864889fe3d370cdeffbbab762af3cb4; systems whose kernel version predates this commit or does not include that change may be vulnerable. No specific version numbers are listed, so a full inventory check against the commit or kernel sources is recommended.

There is no CVSS score provided and the EPSS is unavailable, but the flaw is severe enough to crash the kernel, which could be leveraged for privilege escalation. The vulnerability requires network‑based traffic; an attacker who can inject specially crafted MPTCP packets toward the target can trigger the race condition. An exploit would cause the kernel to dereference a dangling pointer, potentially crashing the system, and after the crash may allow a local attacker to gain higher privileges or gain a foothold locally.