The AFS filesystem in the Linux kernel does not protect symbolic link operations from concurrent access. afs_read_single() is invoked without proper locking and RCU barriers are missing, so multiple get_link calls can race and potentially expose internal buffer data. The flaw is a classic data‑race weakness (CWE‑367) that could allow an attacker to leak sensitive information or destabilise the filesystem when symbolic links are manipulated in parallel.

All Linux kernel deployments that enable the AFS filesystem are affected. The advisory does not list specific kernel releases, so any build using the AFS module before the patch contains the flaw.

The CVSS score of 7.8 categorises the vulnerability as high severity, and the EPSS score of less than 1 % indicates a low but non‑zero likelihood of exploitation. The issue is not listed in the CISA KEV catalog, suggesting it has not yet been actively exploited. Because the flaw primarily accesses internal buffers without proper locking or RCU barriers, data leakage or instability can occur when symlinks are manipulated simultaneously by concurrent processes. Any user who performs symbolic link operations on an AFS mount can potentially trigger the vulnerability. Even though the exploitation probability is low, patching is advisable.