The vulnerability is a double fput() call in the error handling path of cachefiles_create_tmpfile() in the Linux kernel. This double decrement of a kernel reference count could corrupt kernel memory or otherwise destabilise the kernel, potentially affecting system availability.

All Linux kernels built from upstream before the commit that introduced the fix are affected. The patch referenced in the advisory has been incorporated into subsequent kernel releases, so any distribution using a kernel version prior to that commit is potentially impacted.

The CVSS score of 7 indicates a moderately high severity. The EPSS score is reported as < 1%, implying a low probability of exploitation. The flaw resides in kernel code and therefore would require privileged or kernel‑mode execution to be exploited. Based on the description, it is inferred that an attacker with sufficient privileges could trigger the weakness to destabilise the system.