Linux Kernel EUVD-2026-86197

Requires a locally configured fscache/cachefiles caching backend with cachefilesd running (whose setup needs CAP_SYS_ADMIN), and the specific tmpfile-creation error path inside cachefiles_create_tmpfile() must fail - a kernel-internal failure condition that is NOT directly attacker-controlled. Exploitation is limited by: local access only (AV:L), some existing privilege (PR:L), high complexity because the attacker cannot reliably force the error path (AC:H), and the fact that most systems do not enable cachefiles at all. There is no remote or unauthenticated vector.

The provided CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.0) rates this as a high-severity local vulnerability, but the underlying defect - a double fput() in the error-handling path of cachefiles_create_tmpfile() - is a memory-corruption (double-free, effectively CWE-415) bug that is crash-dominant, not a confidentiality issue. There is NO EPSS score, NO CISA KEV listing, and NO public POC, so no exploitation signal supports urgency. Critically, the C:H/I:H claims are overstated: reaching the bug requires the tmpfile-creation error path to fire, which is NOT attacker-controlled - it is a kernel-internal failure condition on a cachefiles backend that must be actively configured (cachefilesd running, CAP_SYS_ADMIN). A realistic reassessment is closer to ~4.5 (C:N/I:L/A:H), reflecting a hard-to-trigger local DoS/UAF rather than a reliably exploitable code-execution or disclosure flaw. This is a patch-in-normal-maintenance item, not an emergency: high CVSS but low real-world risk given the exploitation gating and absence of any exploitation evidence.

A local user on a system with a configured fscache/cachefiles backend (cachefilesd active, requiring CAP_SYS_ADMIN to set up) would need to drive the kernel into the tmpfile-creation error path within cachefiles_create_tmpfile(), causing the same file reference to be released twice and corrupting kernel memory, potentially leading to a crash or use-after-free. No public exploit code exists, and the triggering error condition is not directly attacker-controlled, making reliable exploitation impractical.