A double‑free occurs in the netdev_nl_bind_rx_doit routine when a netlink reply has already been consumed by genlmsg_reply and the error path subsequently frees the same socket buffer using nlmsg_free. The redundant release can corrupt kernel memory, potentially leading to a kernel crash or other unintended kernel state changes.

All Linux kernel builds that do not include the patch introduced by commit 9b019376cbee10c4f9184d1745fa37d156e36f30 are affected. This encompasses every kernel version released before that commit. Distribution kernels that package the upstream source without the fix remain vulnerable until a security update incorporating the commit is applied.

The vulnerability is local; it is triggered when a netlink message path enters the error handling code that frees the socket buffer twice. No network‑exposed vector is described. Exploitability depends on the ability of an attacker to send netlink requests that exercise this error path, which typically requires local access, but could be achieved by a non‑root user depending on the semantics of the affected netlink interface. There is no EPSS score available and the issue is not listed in CISA KEV. The risk is significant because kernel memory corruption can destabilize the system and compromise availability.