A time-of-check to time-of-use race condition in the Linux kernel MPTCP implementation poses a risk of system instability or unauthorized integrity impacts.

The MPTCP output path performs lockless access to sequence numbers, resulting in a TOCTOU (Time-of-Check to Time-of-Use) race condition that can affect the data acknowledgment process.

This vulnerability can lead to service degradation or denial of service, impacting system availability for critical network-heavy applications. Given the CVSS score of 8.2, the potential for network-level disruption necessitates prompt kernel updates to ensure system reliability and data integrity.

Immediate Action: Update the Linux kernel to version 5.15.210, 6.1.176, 6.6.143, 6.12.94, or later depending on your active distribution branch.

Proactive Monitoring: Monitor system logs for kernel panics or MPTCP-related error messages that may indicate instability caused by the race condition.

Compensating Controls: Limit exposure to untrusted network traffic and ensure that kernel hardening features are enabled to mitigate potential exploitation attempts.

Public Exploit Available: No (exploit_available: false)

Linux kernel maintainers have addressed this through stable patches. Organizations should include these kernel updates in their standard patch management cycle to maintain system stability and prevent potential network-based exploitation.