In the Linux kernel, a bug in the netfs read iterator preparation routine causes the kernel to hold onto readahead folio references when a prior read operation fails. The held references are never released, resulting in a memory and resource leak. The vulnerability does not allow arbitrary code execution or direct privilege escalation; the primary consequence is gradual consumption of kernel memory and worsening system performance, which may eventually lead to instability or reduced availability.

The defect exists in the netfs component of the Linux kernel. All Linux kernel builds that include the netfs read iterator logic are potentially affected; no specific version numbers are listed, so the issue applies to the current kernel source code referenced in the advisory.

The CVSS score is not disclosed and the EPSS score is unavailable, but the vulnerability is not listed in CISA KEV. The attack vector is inferred to be local: it requires a kernel to perform a failed read operation, which a privileged user or a malicious local application could trigger by abusing the filesystem read. Because the flaw results in resource exhaustion rather than direct compromise, the risk level is moderate, driven by potential memory pressure and availability degradation.