The Linux kernel rockchip‑sfc SPI controller driver registers its controller with devm_spi_register_controller(), which automatically unregisters the controller during device removal. The driver also calls spi_unregister_controller() in its remove() callback, which can cause a double‑free of the same controller object. According to CWE‑1341 and CWE‑415, this double‑free can corrupt kernel memory.

Linux kernel versions that include the rockchip‑sfc driver prior to the fix commit (for example, commit 111e2863) and any kernel builds lacking that commit are affected. This includes the 7.0 release candidates (rc1, rc2, rc3) and earlier kernels. Systems using Rockchip SoCs and running vulnerable kernel versions with the driver built into the kernel or as a module are impacted; distributions that have incorporated the patch commit are not vulnerable.

The CVSS score of 7.8 indicates a high severity flaw, while the EPSS score of <1% suggests a low likelihood of exploitation, and it is not listed in the CISA KEV catalog. The double‑free occurs during device removal, so an attacker would need the ability to trigger removal of the rockchip‑sfc controller, which typically requires local or hardware access. Based on the description, it is inferred that an attacker would need to have such removal capability to exploit the bug. While the double‑free can corrupt kernel memory, the CVE description does not explicitly state that this leads to arbitrary code execution or privilege escalation; such consequences are therefore not guaranteed by the information provided.