The defect in the Linux AFS module allows a double unmap of a directory block when afs_dir_find_block() is invoked twice in succession. If the block pointer is not cleared before the second unmapping, the kernel attempts to free memory that has already been released, which can corrupt kernel memory. Such corruption may propagate to other kernel structures and cause instability, including kernel panics.

All Linux kernel implementations that load the AFS module before the afs_edit_dir_remove fix are vulnerable. This includes any distribution or custom kernel that has not yet adopted the patch, regardless of the kernel version, because the bug resides in the AFS subsystem of the kernel.

The CVSS score for this issue is 5.5 and the EPSS score is below 1 %, indicating that exploitation is unlikely in the observed data. The vulnerability is not listed in the CISA KEV catalog. The issue requires local or privileged access to the kernel’s AFS operations, so attack vectors are limited to users or processes that can perform AFS directory modifications. Although no publicly available exploits are documented, the potential for serious kernel memory corruption warrants prompt remediation.