The Linux kernel’s amlogic_gxl_crypto driver contains a flaw in meson_crypto_probe where meson_allocate_chanlist may partially allocate resources and then unwind them on failure. The probe’s error path calls meson_free_chanlist again, causing the same resources to be freed twice. This double teardown re‑enters crypto_engine_exit on a worker that has already been destroyed, resulting in a slab‑use‑after‑free error reported by KASAN.

All Linux kernel releases that ship the unpatched amlogic_gxl_crypto driver are affected when the driver is loaded, either at boot or through module insertion. The vulnerability was reproduced against a v7.1-rc2 kernel, implying that earlier kernels (4.x, 5.x, 6.x, 7.x) containing the original code may also be vulnerable. The exact kernel versions affected depend on whether the patch that prevents the double‑free has been applied.

The CVSS score of 7.8 indicates high severity, but the EPSS score is below 1 % and the vulnerability is not listed in CISA KEV, suggesting no active exploitation is known. An attacker would need local access that permits loading or triggering the amlogic_gxl_crypto module, for example via insmod or during system boot. Successful exploitation could lead to a kernel panic or kernel memory corruption, potentially causing a denial of service or creating an execution context for privilege escalation. No public exploitation reports are available at this time.