By exploiting CVE-2016-5696, it's possible for an attacker to infer the existence of a TCP connection between two devices, to disrupt that connection and to inject arbitrary data into the TCP stream, without needing to be in the network path between the two devices.
From reading the articles about this, it's clear only certain systems are going to be vulnerable; generally those with Linux kernel versions greater than 3.6, or where the relevant kernel patches have been back-applied.
Given a TCP connection between a client and a server, it's not clear which of these needs to have the vulnerable kernel for the connection to be potentially vulnerable. Is it sufficient for either end to be running vulnerable code, or is the attack only possible if both ends have the vulnerability?