rpmsg_probe in drivers/rpmsg/virtio_rpmsg_bus.c in the Linux kernel prior to 5.18.4 has a double free.
linux linux kernel