The Linux kernel contains a flaw that causes a leak of the internal vllist structure during afs_update_cell() when no servers are configured. When the server count is zero, the kernel incorrectly keeps the old empty list in memory, allowing the contents of the previous list to remain visible. This exposes kernel memory data and compromises confidentiality of sensitive system information.

The vulnerability affects all Linux kernel implementations that have not yet applied the afs vllist leak fix. Any distribution using the kernel prior to the patch contains the code that can leak vllist information; no specific kernel version is listed, so a broad range of releases is potentially impacted.

The flaw is a memory leak that does not grant direct code execution or privilege escalation. Exploitation would require local interaction with the AFS module, such as activating afs_update_cell(), and would be limited to the privileges of the invoking user. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, indicating limited current exploitation evidence. Nonetheless, the potential for data exposure warrants prompt remediation.