The Linux kernel ipu6 driver improperly frees auxiliary device platform data pointers twice during error unwinding after initialization. Specifically, ipu6_bus_initialize_device() stores the isys/psys pdata pointer and initializes the auxiliary device, but subsequent manual frees of pdata after auxiliary device initialization cause double free. The isys and psys init paths and ipu6_bus_add_device() already handle device release correctly, so the extra kfree(pdata) calls lead to releasing the same object twice. This vulnerability was discovered by static analysis and confirmed by manual source review.

Exploitation of this vulnerability could result in memory corruption due to double free, potentially leading to system instability, denial of service, or privilege escalation. The CVSS score of 7.8 indicates a high impact on confidentiality, integrity, and availability. However, no known exploits in the wild have been reported.

The vulnerability has been resolved in the Linux kernel by removing the manual freeing of pdata after auxiliary device initialization to prevent double free. Since no explicit patch links or affected versions are provided, users should apply the latest Linux kernel updates that include this fix. Patch status is not yet confirmed in the input data; check the official Linux kernel advisories for current remediation guidance.