The Linux kernel's MPTCP implementation improperly accounts for MPTCP-level out-of-order packets in the mptcp_rcvbuf_grow() function. Since MPTCP-level OoOs are normal when multiple subflows are active, counting them causes the receive buffer size to drift towards the maximum TCP receive memory setting, leading to resource mismanagement. Additionally, a subtle race condition with receive space initialization can cause a divide-by-zero kernel crash (Oops) when the first OoO data arrives while user-space holds the MPTCP socket lock. The fix involves removing this incorrect accounting while still accounting for TCP-level OoOs at the subflow level.

This vulnerability does not compromise confidentiality or integrity but can cause denial of service by triggering a kernel crash (Oops) due to a divide-by-zero error. The impact is limited to availability degradation on affected Linux systems running MPTCP with multiple active subflows.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor for kernel updates addressing this issue. No specific workaround is provided in the available data.