The Linux kernel’s MultiPath TCP (MPTCP) path manager can leave a stale ADD_ADDR announcement entry alive when the id 0 endpoint is removed. Because the id 0 removal path does not perform cleanup, the stale entry remains in the announcement list. When the PM later reselects id 0 after adding another signal endpoint, it encounters the stale anno_list entry and triggers WARN_ON_ONCE(mptcp_pm_is_kernel()) in mptcp_pm_announced_alloc(). This flaw is a resource‑management issue that can lead to repeated kernel warnings and potentially instability or denial of service. The description does not indicate remote exploitation; the impact is inferred to be kernel instability or denial of service, not remote code execution.

All Linux kernel installations that include the MPTCP path manager and compile the id 0 removal path that lacks cleanup. Exact kernel versions are not specified, so any kernel older than the upstream patch that incorporates the fix is potentially affected. No specific vendor or product names beyond Linux are listed.

The CVSS score is 5.5 and the EPSS score is <1%, indicating limited public exploitation data. The flaw appears to be local in nature, requiring manipulation of MPTCP sub‑flows or privileged access. There is no listing in CISA's KEV catalog, which suggests no publicly known exploits. However, the bug may allow an attacker to cause repeated WARN_ON_ONCE messages, which could degrade system stability or service availability. The risk is considered moderate to high, given the potential denial of service and the lack of precise exploitation metrics.