The vulnerability resides in the fbdev subsystem of the Linux kernel, where the function of_parse_phandle() increases the reference count of a device node that is later copied into native_mode. On certain error paths, the reference to native_mode is never released, causing a refcount leak. This improper reclamation can lead to gradual kernel memory exhaustion or a crash if the leak is exploited repeatedly. The weakness corresponds to CWE‑911 (Missing Reference Count Decrement) and has also been classified as NVD-CWE-Other.

All configurations of the Linux kernel that include the fbdev subsystem with the legacy display‑timing handling code are affected. Any kernel build that predates the commit that introduces the fix (identified by hash 20881ad4) remains vulnerable. Vendor‑specific information is not provided, so the risk applies to all distributions that ship the affected kernel code without the update.

The CVSS score is 5.5, indicating moderate severity, and the EPSS score is noted as < 1%, meaning the probability of exploitation is low. The vulnerability is not listed in CISA KEV. Based on the description, it is inferred that an attacker would need local kernel privileges to trigger the faulty code path, such as loading a malicious kernel module or invoking an operation that causes display‑timing parsing. Once the reference count leaks, repeated invocations could deplete kernel memory or destabilize the system, effectively denying service. The need for privileged access and the low exploitation probability reduce the likelihood of widespread attack.