The vulnerability in the Linux kernel allows a double free of the mtd_info structure when add_mtd_device() fails, potentially leading to memory corruption. An attacker who can trigger the error path may achieve local privilege escalation or cause a crash, compromising system confidentiality, integrity or availability.

All Linux kernel releases prior to the inclusion of this patch affect systems that use the Memory Technology Device subsystem to register MTD partitions or NVMEM devices. The flaw is present in the kernel code that handles MTD partition registration, so any system that loads or configures MTD devices is potentially impacted.

The CVSS score is not disclosed and EPSS data is unavailable, while the vulnerability is not listed in the CISA KEV catalog. Exploitation would generally require local access to manipulate MTD device registration procedures, making real‑world exploitation less likely but still possible due to the kernel‑level double free condition.