The Linux kernel's cpufreq module has a double free bug in the error handling of the cpufreq_dbs_governor_init() function. When the kobject initialization fails, the code frees the allocated governor data twice: once explicitly and again via the kobject's release callback. This can corrupt heap metadata and may allow an attacker with kernel privileges to manipulate memory, potentially leading to arbitrary code execution or system instability, though the description does not guarantee an exploitable code path.

All Linux kernel deployments that enable CPU frequency governor daemons. The issue applies to any kernel build before the patch that removes the double free in cpufreq_dbs_governor_init(). Users should verify whether their kernel includes the fix present in the referenced Git commits.

The CVSS score of 7.8 and an EPSS score of < 1% indicate a high‑to‑moderate severity with a low probability of exploitation. The vulnerability is not listed in CISA's KEV catalog, indicating no known widespread exploitation. The flaw requires the attacker to trigger the governor initialization failure path, which typically involves loading a kernel module or restarting a service that invokes the governor. These prerequisites limit the likelihood of successful exploitation but do not eliminate it entirely. The attack vector is inferred to be the failure path of the governor's kobject initialization, which demands privileged actions.