The Linux kernel’s vfio/pci subsystem contains a double‑free condition in its dma‑buf handling path, a classic CWE‑415 flaw, because an error branch omits a required dma_buf_put() call and falls through the unwind chain. This causes the reference count of the underlying vfio device to become unbalanced, thus freeing the same memory object twice. The inadvertent circular reference introduced by the improper cleanup is also a CWE‑763 scenario. Such an inconsistency can corrupt kernel memory, destabilize the system, and potentially allow privilege escalation if an attacker can trigger the error code path. The problem is confined to the kernel code and therefore directly affects kernel integrity and stability.

All Linux kernels that include the vulnerable vfio_pci_core_feature_dma_buf implementation before the patch, including release candidate versions 7.0 rc1 through rc5, are affected. Vendors shipping the default kernel without the recent commit are impacted unless the kernel has been upgraded to a patched version that performs dma_buf_put() in the error path.

The CVSS score of 7.8 signals a medium‑to‑high severity, while the EPSS score of less than 1% indicates a very low likelihood of real‑world exploitation. The vulnerability is not present in CISA’s KEV catalog. Exploitation would most likely require local access to a VFIO PCI device from which an attacker could exhaust file descriptors or otherwise force the kernel into the error handling path; remote access is improbable unless the attacker already has local control. Based on the description, the likely attack vector is local interaction with a VFIO device that can induce file descriptor exhaustion. The impact is limited to kernel memory corruption and is unlikely to be leveraged for immediate arbitrary code execution without additional local privilege.