The vulnerability originates from a double free of memory allocated with devm_kzalloc() in the uio_pci_generic_sva driver. The driver frees this memory manually during a failed probe and again when the module is removed, while devm_kzalloc() allocations are automatically released by the device resource framework. This duplicate deallocation can corrupt the kernel heap, potentially allowing an attacker to gain arbitrary kernel execution. The flaw is a classic instance of CWE‑1341 double free.

Any Linux kernel that includes the uio_pci_generic_sva driver, including all mainstream kernel releases prior to the commit that removed the manual kfree() calls. The driver is part of the ubiquitous uio subsystem, so any distribution that builds the Linux kernel with this module enabled is potentially vulnerable.

The EPSS score is below 1 %, indicating a very low predicted exploit frequency, and the flaw is not listed in CISA’s KEV catalog. Because the damage occurs only when a process can trigger the driver’s probe or removal routines, the attack vector is local: privilege escalation or denial of service by an adversary with root or module load rights. No public CVSS score is available, but a successful exploitation of this double free could lead to arbitrary code execution in the kernel space.