rpmsg_probe in drivers/rpmsg/virtio_rpmsg_bus.c in the Linux kernel before 5.18.4 has a double free.
https://github.com/torvalds/linux/commit/c2eecefec5df1306eafce28ccdf1ca159a552ecc
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-37450
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.18.4