The Linux kernel rockchip‑sfc SPI controller driver registers its controller with devm_spi_register_controller(), which automatically unregisters the controller during device removal. The driver also calls spi_unregister_controller() in its remove() callback, causing a second free of the same controller object. This double‑free corrupts kernel memory and can potentially allow an attacker to execute arbitrary code or privilege‑escalate in the kernel.

Linux kernel versions that include the rockchip‑sfc driver before the fix commit (e.g., commit 111e2863) and running on Rockchip SoCs are affected. All kernel builds lacking that commit, regardless of distribution, are vulnerable; the flaw is confined to the rockchip‑sfc driver and does not impact other modules.

Due to the missing CVSS score, the EPSS score is reported as <1% and the flaw is not listed in the CISA KEV catalog. The double‑free occurs during device removal, so an attacker would need to trigger removal of the rockchip‑sfc controller, which typically requires local privileged access or the ability to interact with the device. The likely attack vector is local hardware or system control that can force driver removal. Although exploitation probability is low, the nature of the bug indicates high severity and the possibility of kernel memory corruption leading to privilege escalation.