The Linux kernel Multi‑Protocol Transport Control Protocol (MPTCP) implementation has a flaw in which forward‑allocated memory is not reclaimed when receive‑path errors occur before packets are queued. This oversight allows an attacker to supply crafted traffic that repeatedly triggers such errors, causing forward memory buffers to grow without bound and potentially exhausting system memory, which can result in a denial‑of‑service condition.

This issue affects systems that run a Linux kernel with the MPTCP module enabled. Any kernel version that has not incorporated the commit that restores forward‑memory reclamation prior to enqueueing packets is vulnerable. The problem manifests only when the MPTCP path processes packets that are dropped due to errors, so kernel users must be aware of whether their deployment includes a hardened kernel or has MPTCP disabled.

Based on the description, it is inferred that the attack vector is remote via crafted MPTCP traffic. An adversary could exploit this remotely by repeatedly sending malformed MPTCP packets that trigger receive‑path errors, forcing the kernel to consume additional forward memory that is never freed. The CVSS score of 7.5 indicates a medium‑high severity, while the EPSS score of < 1% suggests a very low exploitation probability. Because the vulnerability is not listed in CISA KEV, it has not been identified as a known exploited vulnerability, yet the nature of the flaw still permits unbounded memory consumption if triggered.