The vulnerability is a double free bug triggered when adding a GPIO auxiliary device in the Linux kernel reset subsystem. When the auxiliary device add routine fails, the error path frees the device structure twice—once during uninitialization and again directly. This misuse of memory can corrupt the heap, potentially allowing an attacker with sufficient privileges to execute arbitrary code or cause a system crash. The flaw corresponds to CWE-416, Use After Free.

All Linux kernel implementations are affected, as the fix was made in the core reset driver and is not limited to specific vendor patches. No version range is listed, so any kernel snapshot before the patch that includes this bug should be considered vulnerable.

The fix occurs in the kernel, so exploitation would require local or elevated access to the kernel, making the attack vector restricted to local users or privileged attackers. With no EPSS data and no listing in CISA KEV, the exploitation probability appears low to moderate, yet the potential impact warrants prompt remediation.