A missing cleanup of channel objects in the Linux mailbox subsystem on a failed probe leaves freed channels while the client structure is still removed by devm allocation. This creates a classic use‑after‑free condition that can leak memory or allow an attacker to corrupt kernel memory, potentially enabling privilege escalation. The flaw aligns with CWE‑416 and may also manifest as a memory leak (CWE‑401).

All Linux kernel builds that include the mailbox subsystem with the mailbox-test module are affected. The vulnerability is present in any default kernel configuration that compiles this legacy module before the applied patch; no explicit kernel versions are listed, so any kernel containing the unpatched mailbox-test module is at risk.

The defect is exploitable from kernel space; an attacker who can trigger a probe failure—by loading the module, manipulating mailbox devices, or abusing related drivers—can exercise the use‑after‑free. With no CVSS score disclosed and EPSS unavailable, the precise exploit likelihood is unclear, but the combination of kernel privilege and a classic use‑after‑free suggests high severity. The issue is not listed in the CISA KEV catalog, indicating no known widespread exploitation, yet the damage potential warrants prompt action.