The Linux kernel AFS subsystem mistakenly applies the AS_RELEASE_ALWAYS flag to all inodes, including symlinks and mountpoints that do not provide a release_folio callback. When the kernel attempts to free memory associated with these inodes, the missing callback causes a null pointer dereference in filemap_release_folio, which triggers a kernel panic. The result is an abrupt system crash that disrupts all processes, achieving a denial‑of‑service state.

All Linux kernel releases that include the AFS file system and have not yet incorporated the commit that removed the inappropriate AS_RELEASE_ALWAYS setting for symlinks and mountpoints. In practice, any distribution running a kernel older than the commit identified by 81e985b4c3a6cbcc443fcdcd3ebda7fcc845d459 (or its successor 9d6b0f6d437e2f8350e08678e5e1d20c11c364f3) remains vulnerable.

The EPSS score is reported as < 1 % and the vulnerability is not listed in CISA’s KEV catalog. The CVSS v3.1 base score of 5.5 indicates moderate severity, yet a null pointer dereference in kernel code remains a critical issue. The likely attack vector involves a local user that mounts an AFS file system with symlinks or mountpoints; such a user can trigger the faulty release path, causing a kernel panic. Despite the low probability of exploitation, the potential impact warrants prompt patching.