The vulnerability arises when a binfmt_misc entry registered with the flag 'F' keeps its interpreter file open for the life of the superblock, leading to a resource leak that matches the definition of CWE-911. This persistent pinning of the interpreter holds the superblock, which in turn pins the mount namespace, so the file is never closed. Based on the description, it is inferred that an attacker can trigger the bug by creating such an entry, which typically requires local privileged access to register a binfmt_misc entry, and that the effect is a denial of service caused by exhausting mount namespace and inode table resources.

Linux kernel versions prior to the patch, across all vendor distributions that include binfmt_misc and allow registration of an interpreter with the 'F' flag, are affected. The issue is present in any environment where the interpreter lives on a mount that keeps that superblock alive, such as user namespaces or overlayfs layers. All users of such kernel variants where binfmt_misc is enabled can potentially be impacted.

The risk is moderate with a CVSS score of 5.5, but the EPSS score is reported as less than 1% and the vulnerability is not listed in the CISA KEV catalog, indicating that active exploitation is unlikely. However, since the attack vector is inferred to be local and the privilege required to create a binfmt_misc entry is typically root or equivalent, the severity remains significant if the environment allows privileged local users to register such entries. Therefore, the vulnerability can lead to a denial of service by continuously consuming mount namespace and inode resources, potentially bringing the system to an unresponsive state.