The vulnerability arises when reconstitutes a Multi‑Protocol Transport Control Protocol (MPTCP) MP_JOIN request during the 4th‑ACK phase controlled by to copy the local_id field, leaving it uninitialized. Because the request‑socket slab is not zeroed, the stale value of local_id can be taken from a previously freed socket, and an off‑path attacker can influence that value by sending concurrent MP_JOIN SYNs. The resulting corrupted‑ID, corrupting the path manager’s bookkeeping of subflows. This corruption can lead to misrouted traffic or a denial of service.

All Linux systems running a kernel that includes the Multi‑Protocol Transport Control Protocol (MPTCP) subsystem with syncookie support and that are not yet updated to the patch that restores the local_id field. No specific kernel release is listed, but the issue affects any kernel that contains the commit that applies the fix.

Because the flaw is triggered by an off‑path MP_JOIN SYN, an attacker must be able to send such packets to the target kernel. The CVSS score of 6.5 indicates a moderate severity, while the EPSS score of < 1% suggests a low probability of exploitation. The vulnerability is not listed in CISA KEV content, implying that no publicly known exploits have been confirmed. Nevertheless, the potential impact on subflow management warrants careful consideration of risk, and monitoring anomalous MPTCP activity is advisable.