Local kernel-state corruption via closed-subflow retransmission race

Race condition in the Linux kernel MPTCP subsystem allows local users to corrupt socket state and interrupt the host. The packet scheduler checks subflow state before taking the socket lock, so retransmission can enqueue data on a subflow that mptcp_close() has already closed. An unprivileged process can trigger the race with MPTCP socket operations when MPTCP is enabled; the demonstrated warning can become a kernel panic when panic-on-warning behavior is configured.