The AFS filesystem in the Linux kernel has a flaw in how it handles symbolic links. The kernel does not acquire the validate_lock when performing afs_read_single() and it omits RCU barriers during RCU pathwalk. These omissions allow concurrent get_link() calls to race, potentially exposing internal buffer contents or corrupting the symlink data. The weakness exhibits classic data‑race behaviour (CWE‑367) and can also lead to improper synchronization problems (CWE‑667). An attacker who can trigger symbolic‑link reads in parallel may cause the kernel to leak sensitive data or destabilise the filesystem.

Any Linux kernel that includes the AFS module is affected. The advisory references kernel releases 7.1 rc1 through rc4 in the CPE list, implying those versions run the vulnerable code. Because AFS is a loadable module, any kernel that has the module built or loaded prior to the patch also contains the flaw.

The CVSS score of 7.8 classifies this vulnerability as high severity. The EPSS score of less than 1 % indicates a low but non‑zero chance of exploitation, and it is not listed in the CISA KEV catalog. Based on the description, the flaw can be exploited by an attacker who has local access to an AFS mount or who can manipulate symbolic links through an AFS process. The likely attack vector is inferred to be local or privileged, rather than remote, with the goal of reading memory or destabilising the filesystem. Although exploitation is unlikely, the impact of a data leak or filesystem instability justifies immediate patching.