An attacker could trigger a double-free in the Linux DRM Xe driver when a graphics device fails to finalize a configuration. The error path in xe_gsc_init_post_hwconfig() frees a buffer that has already been registered for device-managed cleanup, producing kernel memory corruption. This flaw matches a double-free weakness that can lead to privilege escalation or a kernel crash.

Any Linux kernel that ships with the drm/xe driver and does not yet include the upstream commit that removes the second free is affected. The fix is applied in recent mainline releases after commit 71d61e3e. Systems running older kernel versions that have not integrated that commit remain at risk.

The EPSS score is below 1 percent and the vulnerability is not in the CISA KEV catalog, so exploitation is currently uncommon. It is inferred that an attacker would need to trigger a probe failure during driver initialization, which typically requires local privileges or control of the device. Successful exploitation would corrupt kernel memory and could allow an attacker with user-level privileges to gain kernel execution. The CVSS score of 5.5 indicates moderate severity.