The idxd driver in the Linux kernel contains a defect where release callbacks for work queue, engine, and group structures each free the enclosing structure. During error handling and cleanup paths, an explicit kfree is also called after put_device() triggers the release callback. If put_device() drops the reference count to zero, the release callback frees the structure first and the subsequent explicit kfree operates on freed memory, causing a double free. Double free can corrupt kernel memory, potentially leading to a crash or a use‑after‑free that a malicious local attacker could exploit to execute code with kernel privileges. The likely attack vector is local interaction with the idxd device when inducing an error or a cleanup condition.

Any Linux kernel build that includes the buggy idxd code is affected. All distributions shipping such kernels are potentially at risk until the patch that removes the redundant kfree calls is applied. No specific kernel version range is given, so the vulnerability may exist in current and future kernel releases that incorporate the flawed code.

There is no assigned CVSS or EPSS score, and the vulnerability is not catalogued in CISA KEV, indicating no known active exploitation. However, double free flaws are well known to enable kernel memory corruption. A local attacker with sufficient privileges to interact with idxd devices could potentially trigger the double free path, leading to a system crash or, if the attacker can manipulate the corrupted memory, to privilege escalation. The exploitation conditions therefore require the ability to invoke the driver’s error or cleanup logic, which is typically available to local users with device access. The lack of an EPSS score suggests a lower probability of widespread exploitation, but the severity of a successful exploit remains high.