A double-free vulnerability in the Linux kernel V4L2 subsystem could allow a local authenticated attacker to trigger system instability or potential code execution.

This is a memory management flaw involving a double-free condition triggered during error handling in the V4L2 driver registration process. An attacker with local access and low privileges can potentially leverage this race condition or error path to corrupt kernel memory.

The exploitation of this memory corruption vulnerability carries significant risk, as it can lead to a kernel panic, resulting in system downtime and service disruption. Furthermore, successful exploitation of double-free vulnerabilities often enables local privilege escalation or arbitrary code execution within the kernel context. Given the CVSS score of 7.8, this vulnerability is categorized as High severity, necessitating prompt attention for systems utilizing the V4L2 subsystem.

Immediate Action: Update the Linux kernel to version 6.12.109, 6.18.50, 7.2.4, or later versions where the problematic patch has been reverted and the memory handling has been corrected.

Proactive Monitoring: Monitor system logs for kernel oops, segmentation faults, or unexpected system reboots that may indicate memory corruption attempts.

Compensating Controls: Restrict local access to the system to authorized users only, and limit the ability of non-privileged users to interact with video devices via group permissions or udev rules.

Public Exploit Available: Unknown.

The vulnerability represents a critical flaw in kernel memory management that, while requiring local access, poses a substantial risk to system integrity. Security teams should prioritize patching affected Linux distributions as soon as stable kernel updates are released by their respective vendors. Until updates are applied, minimize exposure by restricting user access to local device nodes.