The vulnerability originates in the AFS filesystem client of the Linux kernel, where the parsing function for callback service messages incorrectly returns success instead of the expected -EAGAIN when an incomplete packet is encountered. This misinterpretation can cause the kernel to believe that a callback has been fully processed while still awaiting additional data, potentially leading to resource exhaustion, stalled operations or a denial‑of‑service condition for processes relying on AFS callbacks because the incomplete data is never handled properly.

Any installation of the Linux kernel that includes the AFS client component is potentially affected; the CVE does not specify a particular kernel release, but any version prior to the commit that introduced the fix may be vulnerable.

CVSS score is 7.5 and EPSS score is <1%, indicating high potential severity but low likelihood of exploitation. The attack vector would involve sending crafted incomplete callback messages to the rxrpc service, triggering the kernel to mis‑handle the packet. Because the fix changes a return code from non‑zero to zero, the flaw can be triggered without requiring elevated privileges, suggesting that if exploited it could lead to denial‑of‑service. The vulnerability is not listed in the CISA KEV catalog, so no current known active exploits are reported.