The uacce driver in the Linux kernel lacks a mremap operation in its vm_ops structure. Without an explicit handler, the kernel defaults to a generic mremap routine that copies the original VMA’s private data to a new VMA. If an application maps a region, remaps it, and then unmaps both the original and remapped areas, the default behavior causes the driver’s q->qfr resource to be released twice. Although the driver subsequently nulls the pointer to avoid a repeated release, the double‑free risk remains a classic vulnerability that could be leveraged to corrupt memory or crash the system. Signalling EPERM prevents this scenario but requires an upgrade.

Linux Kernel, specifically the uacce driver component. No specific kernel version numbers are provided in the advisory, but the issue exists in any kernel revision lacking the mremap implementation for the uacce driver. The advisory references multiple Git commits that introduce the fix, indicating the problem was present in the mainline kernel up to the latest stable release at the time of the advisory.

The Exploit Prediction Scoring System (EPSS) indicates a probability of exploitation less than 1%, placing the risk in the very low range. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalogue, suggesting that no public, active exploitation has been documented. The absence of a CVSS score in the advisory makes it difficult to quantify severity precisely, but the potential for a double‑free memory corruption and the local nature of the required calls point toward a moderate to high impact if exploited. Nonetheless, because the default behavior mitigates some aspects (nulling the pointer) and because available systems are expected to apply the fix soon, the immediate threat level remains low. However, it is advisable to apply the available patch promptly, as a double‑free can lead to denial of service or, in some contexts, privilege escalation if the corrupted memory can be leveraged.