The vulnerability arises from an uninitialized field in mptcp_write_data_fin when a DATA_FIN packet is sent without payload. Because the checksum calculation relies on this field, an attacker could influence the checksum value or cause the kernel to transmit stale data, potentially leading to data integrity violations or memory disclosure. The bug is a classic case of improper use of an uninitialized variable and can affect any Linux kernel that processes MPTCP packets.

All Linux kernel releases that include the MPTCP subsystem are potentially affected. The issue is resolved only after the patch that restores zero‑initialization of the checksum field (commit cfcceb7a39fc). No specific version range is listed, so any kernel prior to the inclusion of that commit is at risk.

The CVSS score is not provided and EPSS is unavailable, but given the kernel‑level nature of the flaw and potential for checksum manipulation or information leakage, the risk should be considered high. The likely attack vector is network, with an adversary able to forge or tamper with MPTCP DATA_FIN packets. No publicly known exploits are listed in KEV, but the absence of an EPSS value does not preclude the possibility of future exploitation.