A double‑free occurs in the fastrpc component of the Linux kernel when the INIT_CREATE_STATIC ioctl encounters an error path while creating a static process and later the rpmsg device is removed or unbound. The kernel fails to clear the remote_heap pointer after freeing it on the error path, so the later cleanup routine frees the same pointer again. The description indicates a kernel heap memory corruption. Based on the description, it is inferred that a local attacker could potentially trigger a privilege escalation or, at minimum, cause a denial‑of‑service through a kernel panic. The weakness is a classic use‑after‑free error, classified as CWE‑1341.

The vulnerability resides in the core fastrpc code of the Linux kernel. All kernel releases that contain the affected fastrpc implementation are at risk. No specific version ranges are provided, so any instance of the kernel that implements fastrpc with the described double‑free path should be considered vulnerable.

The CVSS score is not provided, and the EPSS score is unavailable. It is not listed in CISA KEV, indicating that widespread exploitation has not yet been observed. Based on the description, it is inferred that the bug enables a kernel memory corruption that can be exploited locally. The likely attack scenario involves an authenticated or local privileged user that can invoke the vulnerable ioctl on the rpmsg device and then trigger removal or unbinding of the device to hit the double‑free path. Because the bug operates entirely in kernel space, it can lead to local privilege escalation if successfully triggered.