The Linux kernel's qcom-cpufreq-hw driver allocates per-domain data using devm_kzalloc(), which is managed by the device resource management system (devres). The function qcom_cpufreq_hw_cpu_init() stores a pointer to an element of this array in policy->driver_data. However, qcom_cpufreq_hw_cpu_exit() incorrectly calls kfree() on this pointer, which is invalid because the memory is devm-managed. For the first domain, this can cause a double free when the platform device is detached, as devres will also attempt to free the memory. For other domains, the pointer may not be the base allocation, making the free operation unsafe. The resolution is to remove the kfree() call and let devres handle memory release, preventing double free errors.

The vulnerability can cause a double free of kernel memory, which may lead to kernel instability or crashes. There is no indication of known exploits in the wild. The impact is limited to potential memory corruption and system reliability issues in affected Linux kernel versions using the qcom-cpufreq-hw driver.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The fix involves removing the kfree() call from qcom_cpufreq_hw_cpu_exit() to avoid double freeing devm-managed memory. Users should monitor official Linux kernel updates and apply patches when available.