The Linux kernel contains a double free bug in the vfio_pci_core_feature_dma_buf() path. When a VFIO PCI device runs out of file descriptors, the error handling bypasses a proper dma_buf_put(), causing the device’s reference count to become unbalanced. This unbalanced refcount can lead to multiple frees of the same memory region, corrupting kernel memory. If an attacker can trigger this scenario, they may cause a kernel panic or potentially leverage the memory corruption to gain higher privilege or execute arbitrary code.

The flaw affects all Linux kernel versions that include the buggy vfio_pci code and have not yet applied the commit that moves the dma_buf_put() into the error path. Known affected vendors are any Linux distributions that ship the stock kernel. No specific version list is provided, so all current kernels prior to the fix are potentially impacted.

The CVSS score is not listed, and no EPSS score is available, so the exact severity cannot be quantified. The vulnerability is not included in CISA’s KEV catalog, thus no evidence of active exploitation. Based on the description, it is inferred that exploiting the double free would require local access to a VFIO PCI device that can exhaust file descriptors, implying the attack vector is local. Nonetheless, the potential for kernel memory corruption could lead to denial of service or privilege escalation, making the risk significant.