The device‑mapper component of the Linux kernel contained logic that, on a dm_resume failure, would attempt to free a table that had already been allocated by dm_swap_table. This double‑free condition allows the kernel to release the same memory object twice, corrupting kernel memory and potentially causing a kernel crash. The vulnerability is identified by CWE‑415 and CWE‑1341 and is a classic case of improper memory deallocation.

All Linux kernels that lack the commit 259ce9e3fc3a3f8c4e393a2072b8f34302eb4d5a are affected. Systems running a kernel older than that commit are at risk until the fix is applied.

The EPSS score is below 1%, indicating a very low probability of exploitation, and the CVSS score of 7.8 reflects a moderate‑high severity due to potential denial of service via kernel crash. The vulnerability is not listed in CISA's KEV catalog. Exploitation would most likely require a local attacker to trigger the dm_resume failure path; no reports of remote exploitation or privilege escalation are documented in the provided data.