The Linux kernel’s MPTCP Fast‑Open implementation incorrectly marks a subflow as Fast‑Open when a TFO SYN packet with a valid cookie arrives but contains no data. As a result, the kernel sets the is_mptfo flag before confirming that any payload has been queued, leaving a stale state when the receive queue is empty. The stale flag can later cause a state‑confusion error when the connection is validated as fully established, potentially allowing the attacker to cause intermittent connection failures or a denial of service. The flaw is a logic error rather than a buffer overflow, but it still compromises connection reliability. Based on the description, it is inferred that the issue can manifest as connection instability for users relying on MPTCP Fast‑Open. This flaw is identified as CWE-367

All Linux kernels that include Multi‑Path TCP (MPTCP) and Fast‑Open support and have not applied the patch are potentially vulnerable. The cpe string identifies the linux_kernel family, so any distribution shipping a kernel version predating the commit is exposed. The vendor list indicates Linux:Linux, meaning generic Linux kernels, with no specific vendor differentiation.

The likely attack vector is a network‑based packet sent to the listening port that includes a valid Fast‑Open cookie but carries no data. This approach requires only inbound connectivity and no authentication or elevated privileges on the target. Although the EPSS score is very low (< 1%) and the vulnerability is not listed in CISA KEV, the CVSS score of 9.4 indicates high‑severity risk. The flaw stems from a state‑flag manipulation (CWE-367) that can lead to a confusion bug and eventual denial of service, but no active exploitation has been documented.