A race condition exists between the MPTCP disconnect() operation and the retransmission timer within the Linux kernel. The concurrent control flow can corrupt internal status structures, leading the kernel to misbehave or crash during Multi‑Path TCP processing. The flaw manifests as a concurrency bug and a time‑of‑check to time‑of‑use condition (CWE‑366).

All Linux kernels that include an unpatched Multi‑Path TCP implementation are affected. The CNA does not specify a constrained version range, so any kernel build containing the MPTCP module before the referenced commit is potentially vulnerable. Systems that load the MPTCP kernel module or have it enabled in the configuration are at risk.

The CVSS score of 5.5 indicates moderate severity. The EPSS score, being below 1%, and the absence from CISA KEV suggest that active exploitation is unlikely at present. Based on the description, it is inferred that exploiting the race would require manipulating MPTCP connections locally or through privileged escalation, therefore the attack vector is likely local or requires elevated privileges.