This vulnerability in the Linux kernel’s LLC subsystem manifests as a reference count leak in the llc_ui_autobind() routine. After a successful auto-bind, the function keeps an extra reference to a Service Access Point (SAP), yet fails to drop it when the socket closes. Repeated bind/close sequences accumulate SAP entries with a zero reference count, ultimately depleting the pool of dynamic SAP values. When the pool is exhausted, subsequent autobind attempts fail with an –EUSERS error, making applications that rely on auto‑binding unable to establish new connections and effectively causing a denial of service.

The flaw resides in the generic Linux kernel; therefore any distribution that incorporates the affected kernel version is susceptible. The issue is inherent to the kernel’s LLC implementation, but the specific affected kernel releases that contain the buggy llc_ui_autobind logic are not enumerated in the provided data. All Linux hosts running a kernel that has not yet been patched for this reference‑count bug could be impacted.

The CVSS score is not supplied and the EPSS score is unavailable, so the precise exploitation probability cannot be quantified. The vulnerability can be triggered by any actor able to initiate repeated auto‑bind operations against services that use the LLC layer. There is no indication that it has been exploited in the wild or is listed in the CISA KEV catalog. The primary outcome is a local denial of service: repeated use of auto‑bind can exhaust dynamic SAP values, resulting in failed binds, but the flaw does not grant code execution or data exfiltration.