An uninitialised bit is used in the subflow_ulp_clone function while copying synchronization cookie data. Based on the description, this flaw can cause the kernel to interpret arbitrary values, potentially leading to inconsistent state, race conditions, or unintended privilege escalation within the MPTCP subsystem. The weakness is a use of an uninitialized variable.

Vulnerable Linux kernel implementations that include the subflow_ulp_clone routine in the MPTCP subsystem are affected. No specific version range is listed, so based on the commit history, all kernel releases prior to the commit that introduces the fix are potentially vulnerable. Users should verify that their system runs a kernel that contains the updated code.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, making the exploitation likelihood uncertain. No CVSS score is provided in the data, so the severity cannot be quantified. The likely attack would require an attacker to establish a specially crafted MPTCP subflow that exercises the uninitialised bit; success could result in kernel misbehaviour, denial of service, or privilege escalation. Due to the kernel context, any successful exploitation would be highly damaging, but the lack of public exploit data suggests a moderate risk pending further information.