In the Linux kernel’s ipu7 media staging driver, two initialization error paths perform a double‑free of the device’s private data, and a subsequent use‑after‑free can dereference a stale pointer while constructing an error return value. This defect can lead to kernel crashes or corruption of kernel memory. The vulnerability does not disclose data or provide a direct information‑leak scenario; its primary impact is on kernel stability and integrity.

The flaw exists in all Linux kernel releases that contain the unpatched ipu7 staging driver before the resolution commits referenced in the advisory (e.g., commit 837c1f9655421055f751ed34745e820a54a27642 and later). Distribution kernels that ship with this driver and have not incorporated the fixes are affected; the advisory does not specify individual kernel versions.

The CVSS score of 7.8 indicates a high‑severity criticality. The EPSS score is reported as less than 1 %, implying a very low probability of active exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is indirect: an attacker would need to cause a driver initialization failure, which typically requires local or privileged execution. Based on the description, it is inferred that exploitation would involve triggering the error paths that free the device structure prematurely. If successful, the exploitation could compromise kernel integrity and cause a system crash or unstable behaviour.