The Linux kernel project identified a flaw in the PCI endpoint driver, specifically in the epf_ntb_epc_destroy handler. The function duplicated the teardown that the caller was already expected to perform, triggering a double free that leads to a kernel OOPS when .allow_link fails or .drop_link is invoked. This results in a loss of kernel stability and a potential denial of service for the affected host. The weakness is a classic double‑free scenario, producing memory corruption and a crash.

All Linux kernel distributions that include the failing epf_ntb_epc_destroy path are affected. The vulnerability is present in the kernel code base referenced by the provided commit identifiers. No specific version range is listed, so any kernel that has not merged the recent patch commits could be vulnerable.

The exploit requires privileged access to the PCI endpoint subsystem and the ability to trigger .allow_link or .drop_link operations that exercise the faulty teardown logic. Because the condition relies on internal kernel driver state, the attack vector is likely local or requires root, and no publicly available remote exploit is confirmed. The EPSS score is unavailable and the issue is not catalogued in the CISA KEV list, pointing to a moderate but not imminent risk for typical users. Immediate patching should mitigate the risk entirely.