The Linux kernel’s udlfb framebuffer driver contains a use‑after‑free condition. During a remap of the framebuffer to userspace the virtual memory area lacks the necessary vm_ops, so the kernel does not track active memory maps. When the backing buffer is reallocated via FBIOPUT_VSCREENINFO, the old pages are freed while existing page tables still reference them. A USB device disconnect triggers a cleanup that frees those pages, resulting in a use‑after‑free that grants the attacking process arbitrary read and write access to kernel memory.

All Linux kernel builds that include the udlfb framebuffer driver are affected; the issue is present from kernel versions that ship the driver up to the latest upstream kernels before the patch is merged. It does not affect distributions that disable CONFIG_FB_DUMMY or that do not load the udlfb module.

The CVSS score of 7.3 classifies the flaw as high severity. The EPSS score of <1% indicates a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local, requiring the attacker to supply a USB device that interacts with the udlfb driver—for example, a dummy USB host controller or a USB gadget emulation. Inferred from the description, the attacker would need to trigger a framebuffer reallocation or a USB disconnect while the framebuffer remains mapped. Because of the low EPSS and the requirement for a specialized attack scenario, the vulnerability is best regarded as a low‑to‑moderate local risk that could lead to privilege escalation if successful.