The vulnerability resides in the afs_make_call() function of the Linux kernel’s AFS client. A race condition between asynchronous call reception and call destruction allows the function to drop a reference to a call structure that is still being used, resulting in a use‑after‑free error. If an attacker can inject a crafted AFS request (for example, from a remote AFS server), the freed memory can be corrupted, potentially giving the attacker the ability to execute arbitrary code with kernel privileges or cause a denial‑of‑service.

Any Linux system running a kernel that includes the legacy AFS client layer and has not incorporated the commit referenced in the advisory is susceptible. The specific kernel versions are not enumerated, but the fix appears in the kernel tree after the commits listed in the advisory.

It is now known that the CVSS score is 7.8, indicating a high‑severity use‑after‑reference in kernel code. The EPSS score of less than 1% shows a very low current exploitation probability, and the issue is not included in CISA KEV. Based on the description, it is inferred that an attacker could trigger the race condition remotely on a system using AFS, which could lead to memory corruption or arbitrary kernel‑level execution.