The vulnerability stems from the Linux kernel’s 9p client implementation, in which the error path of p9_client_walk() unconditionally calls p9_fid_put() on a fid that may alias the caller’s oldfid. If the walk fails after the request has been sent, this drops a reference that the caller still owns. When the reference count reaches zero, the fid can be destroyed and later accessed, resulting in a use‑after‑free or reference‑count underflow. The flaw is classified as CWE‑825 and can lead to kernel memory corruption.

All Linux kernel distributions that have not applied the patch are vulnerable. The affected code resides in the 9p client subsystem and applies to any kernel version prior to the commit that removes the unconditional p9_fid_put in the error path. In practice, every distribution that ships or has the 9p client enabled without the patch is exposed. No specific version list is provided, but the vulnerability exists in the current Linux kernel source tree until the fix is applied.

The CVSS score of 10 indicates maximum severity for this flaw. The EPSS score is under 1%, reflecting a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be local or privileged, as the flaw requires the attacker to execute a p9_client_walk() that fails after the request is sent. An attacker with such access could trigger the use‑after‑free, potentially causing kernel memory corruption or system instability. With the low exploitation likelihood, the immediate risk to typical deployments is limited, but the high impact warrants prompt remediation.