When a process is forked, the child inherits the parent's virtual memory areas, but the user-mapped reference counter for tracing buffers is not increased. If both parent and child exit, the cleanup routine is invoked twice. On the second invocation the counter is already zero, causing a negative error return and a warning. The vulnerability does not lead to arbitrary code execution or privilege escalation; it simply results in a warning and a benign error code. It may, however, clutter logs or be abused for denial‑of‑service style sabotage, but no direct exploitation path is documented.

This issue is present in the Linux kernel across all versions affected by the tracking commit. The specific version range is not supplied in the advisory. Users running any recent Linux kernel should verify whether the fix is included.

The CVSS score of 3.3 rates this as low severity, and the EPSS probability is below 1 %. It is not listed in the CISA KEV catalog and no exploits are known. The likely attack vector is local: a process with the ability to fork can trigger the double closure by using madvise(MADVISE_DOFORK) to clear the VM_DONTCOPY flag. Because no remote exploitation or privilege escalation is possible, the overall risk is considered low but should still be observed if suspicious warning messages appear.