A double‑free bug exists in the PRUSS clock‑multiplexer setup routine of the Linux kernel. When an error occurs during device initialization, the code releases a device‑tree node reference twice, corrupting kernel memory. This corruption can lead to a kernel crash, but it is confined to kernel space and does not directly affect user‑space applications. The likely attack vector is an attacker who can trigger the fault during PRUSS initialization, such as by manipulating hardware resources or sending crafted device configuration data. (Inferred from the description).

All Linux kernel builds that include the PRUSS driver and have not incorporated the fix are at risk. Distributions running such kernels on hardware that enables the PRUSS subsystem are affected.

The vulnerability is a double‑free that corrupts kernel memory. The CVSS score of 7.8 indicates moderate severity. The EPSS score is less than 1%, indicating a low exploitation probability, and the flaw is not listed in the CISA KEV catalog. Exploitation would likely require a local attacker capable of triggering the fault during PRUSS initialization or a scenario where the device can be controlled remotely. The principal risk is kernel memory corruption that could bring down the system. The attack vector is inferred from the description.