The kernel contains a double mmput() in the PROCMAP_QUERY path. When a user supplies an incorrectly sized buffer for the build ID, the code releases an mm_struct reference twice once the mutex has already been unlocked. This double deallocation can corrupt kernel memory and lead to a crash or denial of service. This double free is a classic double‑free vulnerability (CWE‑415).

All Linux kernel implementations are affected, as the issue is present in the core procfs handling. No specific kernel releases are listed, so a kernel upgrade that incorporates the patch is required.

The CVSS score is not provided, but a double‑free in the kernel can trigger a high‑impact crash. Exploitation would require a user or process that can invoke the PROCMAP_QUERY ioctl with a malformed build‑ID buffer. The EPSS score is unavailable and the vulnerability is not in the CISA KEV catalog. An attacker with local access can cause a kernel panic to disrupt the system and potentially reboot to gain further footholds if memory is compromised.