The idxd driver in the Linux kernel has a flaw that corresponds to CWE-1341: Double Free, where release callbacks for work queue, engine, and group structures each free the enclosing struct. In error handling and cleanup paths an explicit kfree is also called after put_device() triggers the release callback. If put_device() drops the reference count to zero, the release callback frees the structure first and the subsequent explicit kfree operates on freed memory, causing a double free. This double free can corrupt kernel memory, potentially leading to a crash or a use‑after‑free that a malicious local attacker could exploit to execute code with kernel privileges. The likely attack vector is local interaction with the idxd device when inducing an error or a cleanup condition.

Any Linux kernel build that includes the buggy idxd code is affected. All distributions shipping such kernels are potentially at risk until the patch that removes the redundant kfree calls is applied. No specific kernel version range is given, so the vulnerability may exist in current and future kernel releases that incorporate the flawed code.

The CVSS score is 7.0, indicating medium‑to‑high severity for a local attacker. The EPSS score is < 1%, suggesting a very low likelihood of exploitation but not zero. The vulnerability is not listed in CISA KEV. The double free can corrupt kernel memory, potentially leading to a crash or a use‑after‑free that a malicious local attacker could exploit to execute code with kernel privileges. The likely attack vector is local interaction with the idxd device when inducing an error or a cleanup condition. A local attacker with sufficient privileges to invoke the driver’s error or cleanup logic could trigger the double free, leading to a system crash or (if memory is manipulated) to privilege escalation.