The vulnerability involves a memory leak in the Linux AFS (Andrew File System) lookup path, where a failing afs_try_get_volume() call could cause a dying volume to remain allocated. This leak can consume kernel resources over time, potentially degrading system performance or exhausting memory, leading to a denial of service in a worst‑case scenario. The weakness is a classic memory/resource management error corresponding to a leakage of internal kernel objects.

All Linux kernel installations are affected, as the flaw resides in the core afs code. No specific kernel version range is listed; the fix is included in recent kernel releases that incorporate the afs_lookup_volume_rcu update.

The vulnerability resides in kernel code, so exploiting it would likely require code execution with kernel privileges or local system access; however, this is an inferred requirement and not documented. No publicly available exploits or attack evidence exists, and the EPSS score is unavailable, indicating a low to moderate likelihood of exploitation. The issue is not listed in the CISA KEV catalog, suggesting limited real‑world exploitation to date. Because the flaw can lead to resource exhaustion, patching remains prudent.