Linux Kernel EUVD-2026-32785

The vulnerability resides in the MPTCP (Multipath TCP) path manager subsystem of the Linux kernel. MPTCP is a transport layer extension allowing a single TCP connection to utilize multiple network paths simultaneously; ADD_ADDR is the signaling option used to advertise additional addresses for path establishment. During ADD_ADDR retransmission, the kernel acquires a socket reference via sk_reset_timer() but several early-exit code paths within the retransmission handler returned directly without calling sock_put() to decrement the reference counter. This is a reference counting defect consistent with CWE-911 (Improper Update of Reference Count) or CWE-401 (Missing Release of Memory after Effective Lifetime) - though NVD lists no CWE for this entry. The fix consolidates cleanup at a new goto 'exit' label calling __sock_put() unconditionally, and removes a dead '!msk' null check that cannot occur given the MPTCP call graph. CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* covers all affected Linux kernel versions per NVD.