A memory management error in the Linux kernel IPU6 driver poses a high risk of system compromise to local users.

This is a double free vulnerability located in the ipu6_bus_initialize_device function. An attacker with local access and low privileges can trigger an error path that causes memory to be freed twice, leading to potential kernel-level memory corruption.

The vulnerability carries a CVSS score of 7.8, indicating a high severity risk. Successful exploitation could allow a local attacker to crash the system, causing significant operational downtime, or potentially gain elevated privileges by manipulating kernel memory structures. Given the core nature of the Linux kernel, this flaw represents a substantial threat to system integrity and availability.

Immediate Action: Update the Linux kernel to version 6.12.110, 6.18.52, 7.2.6, or a later stable release to incorporate the necessary memory management fixes.

Proactive Monitoring: Review system logs for kernel panics or unexpected process terminations, particularly those related to the media subsystem or auxiliary device drivers.

Compensating Controls: Restrict access to the system to authorized users only, as the vulnerability requires local access to trigger the specific error-handling code paths.

Public Exploit Available: Unknown

System administrators should prioritize patching the Linux kernel to the identified secure versions. While the vector requires local access, the potential for kernel-level impact makes this an urgent maintenance task for any infrastructure running vulnerable IPU6 media driver components.