The Linux kernel’s overlay subsystem has a bug where a newly created property is linked into a target node’s deadprops list before the associated changeset add operation completes. If that operation fails, the property is freed but remains referenced in the deadprops list. When the aborted overlay node is later released, the list element is freed again, resulting in a double free that corrupts kernel memory. This corruption could potentially allow an attacker to overwrite sensitive kernel data.

All Linux kernel installations that include the overlay driver are affected, as the vulnerability is tied to the overlay subsystem and no specific version range is provided in the advisory. The cpe indicates the generic Linux kernel product.

The CVSS score of 4.4 indicates a low severity, and the EPSS score of <1% shows a low likelihood of exploitation. Based on the description, it is inferred that exploiting the double free would require local access to the overlay filesystem and the ability to trigger a failed property addition, potentially leading to kernel memory corruption and local privilege escalation. However, the advisory does not detail a confirmed exploitation technique.