In the Linux kernel the cachefiles subsystem was found to pass a dentry to cachefiles_bury_object() with an incorrect reference count. The function expects two references to the cached object, but due to a missing call to start_removing_dentry() in cachefiles_cull() it received only one. Based on the description, it is inferred that this mismatch can decrement the reference counter incorrectly, leading to a use‑after‑free or memory corruption scenario that could be exploited to execute arbitrary code with kernel privileges.

The affected product is the Linux kernel; the issue exists in implementations that contain the cachefiles.c code prior to the commit that applied the patch. Specific kernel version numbers are not enumerated in the advisory.

Based on the description, it is inferred that the vulnerability can lead to kernel‑level code execution through a use‑after‑free, exposing the system to local attackers who can trigger cachefiles_cull() by manipulating cached file objects or by inducing the subsystems to run. No CVSS or EPSS values were provided and the vulnerability is not listed in the CISA KEV catalog, so the exact exploitation probability is uncertain. It is also inferred that the potential impact is high and the attack vector is likely local or requires high privilege.