The vulnerability arises from a double mmput() call within the do_procmap_query() path of the Linux kernel. When a user supplies an overly large buffer for the build ID during the PROCMAP_QUERY ioctl operation, the kernel path performs an mmput() after unlocking a lock; the subsequent error handling path also attempts to mmput() the same mm_struct, resulting in a double free (CWE‑1341, CWE‑415). This double deallocation can corrupt kernel memory and lead to a kernel panic, effectively causing a denial of service for the affected system.

All Linux kernel distributions that include the unpatched core procfs implementation are affected, including kernel 6.19 and earlier releases. Users should upgrade to a kernel version that incorporates the referenced commit(s).

The CVSS score of 7.8 indicates a high impact vulnerability. With an EPSS score of < 1%, the vulnerability has a very low probability of exploitation, and it is not listed in the CISA KEV catalog, suggesting that it is not a known widely exploited weakness. An attacker would need local or user‑level access to invoke the PROCMAP_QUERY ioctl with a malformed buffer; based on the description, the local‑access requirement is inferred rather than explicitly stated.