The vulnerability stems from the device mapper’s resume path attempting to free a table that has already been instantiated. If dm_resume fails, the kernel calls dm_table_destroy on a table that was allocated by dm_swap_table, potentially corrupting memory. This double‑free weakness (CWE-1341) could manifest as a kernel crash or could provide an avenue for privilege escalation if an attacker can reliably trigger the failure conditions, albeit the exact impact is inferred.

All Linux kernel releases that do not contain commit 259ce9e3fc3a3f8c4e393a2072b8f34302eb4d5a are affected. Systems running a kernel older than the patch that fixes the double‑free logic are at risk.

The EPSS score is < 1%, and the CVSS score is 7.8. The vulnerability is not listed in CISA's KEV catalog, indicating no publicly known active exploitation. Exploitation would likely require local privilege to trigger the dm_resume failure path, and while the likelihood of exploitation is low, the potential for kernel memory corruption warrants timely attention.