The vulnerability in the Linux kernel AFS implementation causes error codes to be set only on the first iteration of a loop in the afs_extract_vl_addrs() function. This bug leads to inaccurate error reporting during AFS operations, but it does not provide a direct exploit path or compromise confidentiality, integrity, or availability. The issue is an example of improper error handling (CWE‑701).

All Linux kernel installations that include the AFS filesystem, regardless of distribution. The patch applies to any kernel version containing afs_extract_vl_addrs(); no specific version range is listed, so all affected kernels should be updated.

The CVSS score is 7.5, indicating a high severity impact if exploited. The EPSS score indicates a very low exploitation probability (<1%) and the flaw is not listed in CISA’s KEV catalog, suggesting no known exploitation attempts. Based on the description, it is inferred that the attacker would need local privileged access to the kernel to trigger the error condition. The risk level is moderate to high, given the combination of a high CVSS score and low exploitation probability. An exploit would require local AFS operations and misinterpretation of status codes, offering no actionable gains.