The vulnerability in the Linux kernel allows a double free of the mtd_info structure when add_mtd_device() fails, potentially leading to memory corruption. An attacker who can trigger the error path may achieve local privilege escalation or cause a crash, compromising system confidentiality, integrity or availability.

All Linux kernel releases prior to the inclusion of this patch affect systems that use the Memory Technology Device subsystem to register MTD partitions or NVMEM devices. The flaw is present in the kernel code that handles MTD partition registration, so any system that loads or configures MTD devices is potentially impacted.

The CVSS score of 5.5 indicates moderate severity. The EPSS score of < 1% suggests a low likelihood of exploitation in the wild, and the vulnerability is not currently listed in the CISA KEV catalog. Successful exploitation would require local access to trigger the add_mtd_device() error path and could lead to memory corruption, potentially allowing a local attacker to gain privilege escalation or cause a denial‑of‑service crash. The double‑free condition arises from the MTD subsystem's handling of partition registration errors.