In the Linux kernel the Qualcomm cpufreq hardware driver allocates per‑domain data with devm_kzalloc() and stores a pointer to an element of that array in the policy structure. During driver exit it incorrectly frees that pointer with kfree(), which is invalid because the allocation is device‑managed. For the first domain this can free the devm allocation while the devres entry is still active, and for other domains the pointer may refer to an interior element. The double free corrupts kernel memory, which can lead to a kernel crash.

The flaw affects any Linux kernel that includes the qcom-cpufreq-hw driver. Since no specific kernel version is listed, all deployments that ship with this driver and predate the commit that removes the kfree() call are potentially vulnerable.

The CVSS score is 7.0, indicating a high impact. The EPSS score is <1 %, indicating a very low likelihood of exploitation. The vulnerability is not in the CISA KEV catalog. The double free can lead to kernel memory corruption and a crash. Because the flaw occurs during driver exit, the likely attack vector is local and requires the ability to unload or detach the driver after it has loaded. If exploited, an attacker could cause a denial of service by crashing the kernel.