The Linux kernel suffers a use‑after‑free and double‑free in the pcc_cpufreq_do_osc() function during the ACPI _OSC two‑phase negotiation. After the first acpi_evaluate_object() call, the kernel frees the output.pointer buffer while leaving output.length unchanged, and the second call mistakenly re‑writes to this freed memory, followed by a second kfree of the same pointer. These memory corruption bugs can be leveraged to overwrite kernel data structures, potentially allowing an attacker to execute arbitrary code in kernel mode or crash the system.

This flaw exists in the Linux kernel and therefore affects all Linux distributions using kernel versions that contain the buggy pcc_cpufreq_do_osc() implementation. Versions prior to the patch commits referenced in the provided git patches are vulnerable; the issue spans current and older releases until the kernel is updated.

EPSS is very low at less than 1%, and the vulnerability is not listed in CISA’s KEV catalogue, indicating limited current exploitation. The CVSS score of 7.8 reflects high severity, underscoring the risk of kernel memory corruption that could enable an attacker to execute arbitrary code in kernel mode. The likely attack vector involves invoking the ACPI _OSC negotiation through firmware interactions, which may be performed locally or via malicious firmware modifications. The combination of low EPSS, absence of known exploitation, and the memory corruption risk warrants prompt patching, though the immediate risk is mitigated by the low exploit probability.