The Linux kernel's idpf driver contained a vulnerability involving double free and use-after-free in auxiliary device error paths. Specifically, when auxiliary_device_add() fails in idpf_plug_vport_aux_dev() or idpf_plug_core_aux_dev(), the error handling code calls auxiliary_device_uninit(), which triggers put_device() and frees the device structure (iadev). However, the code then falls through and attempts to access and free the already freed device structure again, causing double free and use-after-free issues. A prior commit fixed a similar issue in the unplug path but missed these probe error paths. The fix involves freeing the IDA slot and clearing the back-pointer before uninitialization to avoid accessing freed memory.

Successful exploitation of this vulnerability could lead to memory corruption in the kernel, potentially allowing an attacker with local privileges to cause a denial of service (system crash) or escalate privileges due to the high impact on confidentiality, integrity, and availability as indicated by the CVSS vector. However, exploitation requires local access and low complexity.

A fix is available in Linux kernel versions 7.0.0-28.28.1 and later. Users should upgrade to these or newer patched kernel versions to remediate this vulnerability. Since this is not a cloud service, manual patching is required. There are no vendor advisories indicating that no action is required or that the issue is already mitigated otherwise.