The Linux kernel contains a double‑free flaw in the xen/privcmd memory handling code. When a userspace process performs a partial munmap() on a privcmd mapping, the kernel splits the VMA without a .may_split check. The split creates a duplicate VM object that points to the same pages array, and both the original and split VMAs close handlers free that array. The double free in kernel space can corrupt kernel memory and allow an attacker to execute arbitrary code with elevated privileges.

All Linux kernel releases that include the unpatched xen/privcmd module are vulnerable, because the issue is triggered by any kernel that still contains the original privcmd implementation. No specific version range is provided in the advisory, so any kernel before the XSA‑487 patch that contains the old privcmd code may be affected.

The CVSS score of 7.8 denotes moderate to high severity, and the EPSS score of <1% indicates a low overall exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. The description does not state the exact attack surface, but the likely attack vector is a userspace process that has the ability to create a privcmd mapping—a privilege that is normally reserved for trusted system components or privileged users. Based on the description, it is inferred that an attacker controlling such a privileged process could trigger the double free and then abuse the resulting kernel memory corruption to obtain arbitrary code execution.