The vulnerability in the Linux kernel’s udlfb framebuffer driver allows a use‑after‑free condition. When a framebuffer is remapped to userspace with remap_pfn_range(), the virtual memory area is not assigned vm_ops, so the kernel cannot track active mmaps. If the underlying buffer is subsequently reallocated via FBIOPUT_VSCREENINFO, the old pages are freed while existing PTEs still reference them. A disconnect of the USB device triggering dlfb_ops_destroy() can then cause the kernel to free pages that are still mapped, resulting in a use‑after‑free that gives the process arbitrary read and write access to freed kernel memory.

All Linux kernel versions that include the udlfb framebuffer driver are affected, as the patch is not present in the default kernel trees. The vulnerability applies to any distribution that enables the udlfb framebuffer path.

A CVSS score is not provided, and the EPSS score is not available; the vulnerability is not listed in the CISA KEV catalog. Attackers would need to manipulate a USB device that interacts with the udlfb driver (e.g., a dummy USB host controller or raw gadget emulation) to trigger the reallocation or disconnect sequence. The vulnerability is therefore likely a local threat that requires privileged or user‑space access to the affected device or kernel interface and has not been reported as a widely exploited vulnerability.