The vulnerability is a double free bug triggered when adding a GPIO auxiliary device in the Linux kernel reset subsystem. When the auxiliary device add routine fails, the error path frees the device structure twice—once during uninitialization and again directly. This misuse of memory can corrupt the heap, potentially leading to system instability. The flaw corresponds to CWE-1341 and CWE-415.

The affected products are Linux kernel builds that contain the reset subsystem’s GPIO auxiliary device code before the fix was applied. This includes all current mainline Linux kernel releases up to and including the 7.0 release candidates, as indicated by the CPE strings. System administrators should verify whether their kernel version implements the commit that removes the double free.

The CVSS score of 7.8 indicates moderate to high severity, while the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation would require the attacker to trigger the error path in reset_add_gpio_aux_device, which typically means privileged access or a local exploitation path; remote exploitation is not directly inferred from the description.