In the Linux kernel, the autofs subsystem can leak a pipe file reference when autofs_fill_super() fails and the superblock is later freed by autofs_kill_sb(). This occurs because the cleanup routine short‑circuits when the AUTOFS_SBI_CATATONIC flag is still set, so fput(sbi->pipe) is never called. The result is a permanent leak of a struct file reference, which can exhaust file descriptors or memory over time. This flaw is an instance of resource management weakness (CWE‑775).

The vulnerability affects the Linux kernel in any release that includes the autofs filesystem and the described logic, before the commit that adds the missing fput call. All Linux distributions using the kernel without this patch are potentially affected. No specific version range is listed, so any kernel build prior to the fix needs to be considered at risk.

The flaw does not have an assigned CVSS score, and no EPSS score is available. It is not listed in the CISA KEV catalog, indicating no known exploitation in the wild. The issue exists at kernel level, and requires local or privilege‑escalation‑level access to trigger. Because exploitation would involve repeated internal failures or a kernel code path, the realistic risk is moderate to low until a kernel upgrade is applied.