In the Linux kernel DRM subsystem, the hw_engine_init error path performs an explicit free of a buffer object that already has a devm cleanup action. This double‑free corrupts kernel memory and can allow an attacker to execute arbitrary code at kernel privilege level or destabilize the system. The flaw is a CWE‑1341 (Double Free) weakness that compromises confidentiality, integrity, and availability at the host level.

The vulnerability exists in any Linux kernel that contains the buggy hw_engine_init implementation for the XE hardware engine in the DRM subsystem. It applies to all kernel releases prior to the commit that removes the explicit free. Ordinary Linux distributions shipping a kernel with the DRM XE driver before the fix are potentially impacted.

The CVSS score is 7.0, indicating a moderate to high severity. The EPSS score is below 1%, implying a very low exploitation probability according to the EPSS model. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker must trigger a driver probe failure while the driver is loading, which typically requires local access or the ability to supply a malformed GPU device or crafted driver. Thus, the likely attack vector is local, and while the probability of exploitation is low, the potential impact warrants timely remediation.