The vulnerability arises from the Linux kernel’s MultiPath TCP (MPTCP) stack accepting combinations of suboptions that are mutually exclusive according to RFC8684 or incompatible with kernel logic. Without proper validation, these conflicting suboptions could be processed, leading to inconsistent state or protocol confusion within the network stack. The applied fix restores strict checks so that any offending suboptions are ignored, preventing unreliable socket behavior and potential service interruption. The primary impact is therefore a disruption of network communication that could manifest as a denial of service for affected connections.

All builds of the Linux kernel that include the legacy MPTCP stack and have not applied the recent patch are potentially affected. The CVE lists a generic Linux kernel CPE, and no specific vendor or version information is provided, meaning any distribution running the default MPTCP support before the fix may be vulnerable.

Exploitation would require an attacker to transmit specially crafted TCP segments containing conflicting MPTCP suboptions to the target host. This is a remote, network‑based attack vector. The CVSS score of 9.8 indicates critical severity, but the EPSS score of less than 1% shows low likelihood of exploitation in the wild, and the vulnerability has not been listed in the CISA KEV catalog. Successful misuse could degrade or interrupt network communication but no publicly known exploit exists at this time.