The flaw is in the Multi‑Protocol Transport Control Protocol (MPTCP) path of the Linux kernel. During subflow teardown, the backlog cleanup of socket buffers was performed without holding the required data lock, causing a race condition. This race can leave a socket buffer pointing at a socket that has already been freed, leading to a use‑after‑free when the backlog is eventually purged. The weakness is an instance of improper synchronization (CWE‑825).

Any Linux system that runs a kernel containing the vulnerable MPTCP implementation and has MPTCP enabled is potentially affected. The patch belongs to commit 625fc6060864889fe3d370cdeffbbab762af3cb4; systems whose kernel version predates this commit or does not include that change may be vulnerable. No specific version numbers are listed, so a full inventory check against the commit or kernel sources is recommended.

The CVSS score of 9.8 indicates high severity, and the EPSS score of < 1% suggests a low likelihood of exploitation at present. The flaw can lead to a kernel crash due to a use‑after‑free during backlog purge. Based on the description, it is inferred that an attacker who can inject MPTCP packets toward the target may trigger the race condition, but there is no confirmed indication that this vulnerability can be leveraged for privilege escalation. The vulnerability requires network traffic to the vulnerable kernel and a period during which a subflow is closing.