The vulnerability in the Linux kernel drm/xe/nvm driver allows a double‑free of a kernel object during auxiliary device initialization failure. Based on the description, it is inferred that the attacker would need to trigger a failure in auxiliary_device_add()—for example by interacting with the xe driver’s device initialization routine—to exploit the flaw. A double‑free can corrupt memory, potentially leading to a kernel crash or a foundation for arbitrary code execution if an attacker can control the freed memory. The weakness is identified as CWE‑415.

Linux kernel versions that include the xe driver before the fix are affected. The known impacted releases are 6.17 and the 6.19 release candidates 6.19‑rc1 through 6.19‑rc7. Any Linux distribution shipping those kernels without the patch is vulnerable.

The CVSS score of 7.8 indicates high impact, but the EPSS score of less than 1% signals a low overall exploitation probability in the wild. The vulnerability is not listed in CISA’s KEV catalog, implying no known widespread exploitation. Typical exploitation would require local privileged access or the ability to trigger the auxiliary device add path in the xe driver, which is not an easily reachable network interface.