The pci_epf_alloc_doorbell function in the Linux pci‑ep‑msi driver stored a newly allocated doorbell message array in epf->db_msg and epf->num_db before requesting MSI vectors. If the MSI allocation failed, the array was freed but the epf structure still pointed to that freed memory. Later cleanup logic could attempt to free the array again or otherwise operate on the stale pointer, causing a double‑free that corrupts kernel memory. The patch clears these pointers on allocation failure and returns –EBUSY when a doorbell allocation already exists to avoid leaking or overwriting an existing allocation.

All Linux kernel releases that contain the pci‑ep‑msi endpoint driver before the commit that adds the defensive clears are affected. This includes every distribution kernel that shipped the original pci_epf_alloc_doorbell implementation as of the patch was merged; the vendor is Linux, the product is the Linux kernel.

The likelihood of an attacker exploiting this flaw hinges on the ability to force a failed MSI allocation for a PCI endpoint device that relies on the pci‑ep‑msi driver, and subsequently trigger the cleanup path that would double‑free the memory. The likely attack vector is local privilege; an attacker with control over the host and the device can orchestrate the failure scenario, potentially leading to kernel memory corruption, denial of service, or, in some configurations, arbitrary code execution. The CVSS score of 7.8 indicates high severity. The EPSS score of <1% indicates a very low probability that this weakness will be actively exploited in the wild. The vulnerability is not listed in CISA’s KEV catalog, meaning no publicly known exploits are documented. The description does not explicitly state the exploitation conditions, so the above conclusions are inferred based on the demonstrated flaw behavior.