An incorrect reference count in the cachefiles subsystem caused by an oversight in cachefiles_cull() inadvertently releases a dentry reference prematurely. The function cachefiles_bury_object expects two references, but only one is supplied, resulting in a counter that under‑decrements. This under‑decrement can lead to a use‑after‑free or other memory corruption inside the kernel. The vulnerability may allow an attacker able to trigger the faulty cache eviction path to cause a crash or, potentially, execute arbitrary code with kernel privileges.

The vulnerability impacts Linux kernels that include the cachefiles feature and have not yet incorporated the missing reference added in the patch. No specific kernel version numbers are documented, so any pre‑patched kernel that supports cachefiles qualifies as vulnerable. The affected product is the Linux operating system kernel; all distributions that ship the kernel with active cachefiles support are potentially affected.

The CVSS score of 7.8 signifies high severity. The EPSS score of <1% indicates a low probability of exploitation in practice. The vulnerability is not listed in the CISA KEV catalog. Exploitation would likely require local privilege or the ability to influence cache eviction in a filesystem that uses cachefiles, as the flaw is limited to kernel memory handling. No remote exploitation vectors are documented, and the exploitation path requires internal code path within the kernel, making it a local issue.