The Linux kernel’s LLC subsystem suffers from a reference‑count leak in the llc_ui_autobind() function. An extra reference to a Service Access Point (SAP) is retained after a successful auto‑bind and is not released when the socket closes. Repeated bind‑close cycles accumulate SAP entries with a zero reference count, eventually exhausting the dynamic SAP pool. When the pool is depleted, subsequent autobind attempts fail with an –EUSERS error, preventing services that rely on auto‑binding from establishing new connections and resulting in a denial of service.

The flaw resides in the generic Linux kernel; therefore any distribution incorporating the affected kernel version is susceptible. The specific kernel releases that contain the buggy llc_ui_autobind logic are not enumerated in the provided data, so all Linux hosts running a kernel that has not yet been patched for this reference‑count bug could be impacted.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score is <1%, suggesting a low but non‑zero likelihood of exploitation. The likely attack vector is repeated auto‑bind operations by a local or user‑level process against services that use the LLC layer. Based on the description, the exploit can only cause a local denial of service: SAP exhaustion leads to failed autobind attempts, but the flaw does not grant code execution or data exfiltration. No known wild exploitation or CISA KEV listing is reported.