The bug causes the Linux kernel's dmaengine pxa driver to double count hardware descriptors. The descriptor counter is first set by kzalloc_flex and subsequently incremented again by a loop, making the total count double. As a result, pxad_free_desc() iterates over more entries than were actually allocated, freeing entries that never existed. This unintended double‑free can corrupt the kernel heap, crash the system, or be leveraged by an attacker with local kernel access to achieve privilege escalation or denial of service.

Linux kernels that include the dmaengine pxa driver and lack the recent commit. All releases prior to the fix are affected; the exact version span is not specified but any kernel that has not been updated to the patched source is vulnerable.

The CVSS score of 7.8 indicates a high severity vulnerability. The EPSS score of <1% indicates a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed active exploitation. The likely attack vector is local; an attacker must trigger dmaengine operations that use the pxa driver or otherwise cause kernel code paths that allocate and free descriptors. Because the flaw manifests as a memory corruption race due to double counting of descriptors, exploitation would require local code execution or the ability to influence DMA requests. The risk to remote attackers is low, but the local impact remains significant until a kernel update is applied.