The Linux kernel AFS subsystem contains a defect (CWE-911) where the ".mmap_prepare" callback may increment a reference count that is not decremented if a merge or allocation failure occurs following the call. This defect could result in a reference count leak affecting kernel objects.

The defect is present in the Linux kernel source. All systems running a kernel that includes the buggy commit before the revert may be affected. No vendor‑specific version information is provided, so any Linux kernel that incorporates that commit is potentially vulnerable until the revert is applied.

The CVSS score of 7.8 indicates a high severity vulnerability with potential impact on system integrity and availability. The EPSS score of less than 1 % suggests that the likelihood of this vulnerability being actively exploited in the wild is quite low at present. Because the vulnerability is not listed in the CISA KEV catalog, no widespread active exploitation is known. The flaw originates from an improper use of the .mmap_prepare callback, which may result in a reference count leak that could lead to resource exhaustion over time if not addressed.