A use‑after‑free occurs when a framebuffer device is unregistered; the mode pointer in the global fb_display array is not cleared, so subsequent ioctl calls dereference a freed pointer. This can allow a local attacker that can access the /dev/fb* devices to read or write arbitrary kernel memory, potentially leading to privilege escalation or denial of service. The weakness is a classic Use‑After‑Free (CWE‑416).

The flaw is present in all versions of the Linux kernel that include the framebuffer subsystem, as no specific version bounds are listed. It affects the Linux kernel product from the Linux Vendor.

The CVSS score of 7.0 indicates medium severity, and the EPSS score of less than 1 % suggests a very low likelihood of exploitation today. The vulnerability is not listed in CISA’s KEV catalog, indicating that no widespread exploitation has been observed. However, the exploit requires local privileged interaction with framebuffer device drivers and careful timing (module unload while the console is still using the device). If an attacker can satisfy these conditions, they could corrupt kernel memory and potentially gain root access.