The Linux kernel contains a race condition in the Multi‑Path TCP (MPTCP) scheduler. When the scheduler selects a subflow socket to transmit data, it may concurrently acquire a state change that sets the socket’s maximum segment size to zero. This can cause transmission failure and later lead the kernel to perform a division by zero using the reset mss_now value, potentially crashing the system.

The vulnerability affects all Linux kernel implementations that enable MPTCP, regardless of distribution. No specific kernel version is listed, so any kernel still running a version before the patch commit is potentially vulnerable. Linux kernel builds that include MPTCP support – such as those from mainstream distributions – fall under the affected scope.

The CVSS score is 7.5, and the EPSS score of <1% indicates a very low but non‑zero likelihood of exploitation. The vulnerability has not been listed in CISA’s KEV catalog, so the exact likelihood of exploitation remains uncertain. The race between the scheduler and the subflow state change suggests a local kernel race that may be triggered by carefully crafted MPTCP traffic. Without a known exploit or proof of concept, the risk remains theoretical, yet any system vulnerable to a kernel crash can be rendered inoperable, justifying prompt patching.