The Linux kernel contained a double-free vulnerability in the drm/xe/gsc driver related to managed buffer objects (BOs). Specifically, in the error handling path of xe_gsc_init_post_hwconfig(), a BO allocated via xe_managed_bo_create_pin_map() was freed explicitly using xe_bo_unpin_map_no_vm(), even though devm had already registered a cleanup action for it. This led to a double-free when devm unwound during probe failure. The patch removes the explicit free call, allowing devm to manage the BO lifecycle uniformly with other callers of xe_managed_bo_create_pin_map().

A double-free vulnerability can lead to undefined behavior including potential kernel crashes or memory corruption. However, no known exploits in the wild have been reported for this issue. The impact is limited to the Linux kernel's drm/xe/gsc driver during error handling in hardware configuration initialization.

A fix has been applied to the Linux kernel source code to remove the explicit free of the managed BO in the error path, relying on devm for cleanup. Users should update to a Linux kernel version that includes this patch. Since this is a kernel-level fix, applying the updated kernel is the recommended remediation.