The vulnerability originates from a double free of memory allocated with devm_kzalloc() in the uio_pci_generic_sva driver. The driver frees this memory manually during a failed probe and again when the module is removed, but devm_kzalloc() allocations are automatically released by the device resource framework. This duplicate deallocation can corrupt the kernel heap, potentially allowing an attacker to gain arbitrary kernel execution. The flaw is a classic instance of CWE‑1341 double free.

Any Linux kernel that includes the uio_pci_generic_sva driver, including all mainstream kernel releases prior to the commit that removed the manual kfree() calls. The driver is part of the ubiquitous uio subsystem, so any distribution that builds the Linux kernel with this module enabled is potentially vulnerable.

The damage occurs only when a process can trigger the driver’s probe or removal routines, so the most likely attack vector is local, requiring root or module load privileges to provoke the double free. The CVSS score of 7.8 indicates high severity, but the EPSS score shows a very low exploitation probability (< 1%). The vulnerability is not listed in the CISA KEV catalog, which further suggests limited known exploitation activity. A successful exploitation could lead to arbitrary code execution in the kernel.