The Linux kernel had a bug in the netfs_write_begin() routine where an error condition caused a reference to be leaked during cleanup. This leak could lead to a gradual exhaustion of kernel resources, resulting in degraded performance or a denial‑of‑service scenario if the error path is triggered repeatedly. The vulnerability is identified as CWE‑772: Unreleased Resource in a Disposable Object and also as CWE‑401: Missing Release of Resource After Use.

All systems running the Linux kernel that had not yet applied the committed fix for CVE‑2026‑64060 are vulnerable. The affected component is the netfs (network filesystem) subsystem within the kernel. No specific kernel releases are listed in the data, so any kernel version before the fix is at risk.

The CVSS score of 5.5 places the vulnerability in the moderate range. The EPSS score of less than 1% indicates a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Exploitation is likely to require local system access or elevated privileges to trigger the error path and cause resource exhaustion. The risk is primarily limited to potential denial of service rather than remote code execution or data compromise.