The octeontx2-pf driver in the Linux kernel contains a double free bug in its pool allocation routine. During AQ initialization, freeing pool->stack when a mailbox sync or retry allocation fails releases memory but leaves the pointer unchanged. A later cleanup path then frees the same memory again, corrupting kernel memory, a classic example of CWE-415 double free and also covered by CWE-1341 memory corruption. This corruption can trigger kernel crashes or allow an attacker with local kernel access to exploit the double free for privilege escalation.

All Linux kernel revisions that include the octeontx2-pf driver and the CN20K-specific cn20k_pool_aq_init routine before the patch are affected. The issue was identified in v6.13-rc1 and persists through v7.1-rc3, and is likely present in any earlier releases that retain the same driver code.

The CVSS score of 7.0 classifies this double‑free flaw as a high‑severity kernel memory corruption vulnerability. Despite the low EPSS (<1%) and the fact that it is not listed in CISA KEV, the potential impact remains significant because it could trigger a kernel crash or enable local privilege escalation. The attack vector appears to be local: an attacker must have access to OcteonTX2/CN20K hardware and be able to trigger the driver. Remote exploitation is unlikely without direct device access. The narrow attack surface combined with the low exploitation probability makes this risk moderate, but an affected host should still apply the patch promptly.