In the Linux framebuffer driver, the defio subsystem tracks deferred I/O state through a structure tied to the lifetime of a fb_info instance. When a device is hot‑unplugged while user space still keeps an active mapping of the device’s graphics memory, the kernel frees the fb_info but does not immediately clean the deferred I/O mapping. The later cleanup clears a pointer inside the state, so any subsequent access dereferences a dangling pointer and results in a SIGBUS termination of the kernel. This represents a classic use‑after‑free flaw that forces a kernel panic and loss of availability, but does not provide an avenue for arbitrary code execution. Based on the description, it is inferred that the primary damage is a denial‑of‑service scenario at the system level.

All Linux kernel releases that contain the vulnerable fbdev defio implementation before the patch referenced by commit 25c2b77bc463f29ee71a54b883548baf9386a0db are affected. The flaw is present in the vanilla kernel and any downstream derivation that has not merged the commit, regardless of distribution. The affected vendor is Linux, and the affected product is the Linux kernel across all architectures that compile the fbdev subsystem.

The vulnerability leads to an uncontained kernel crash when a hot‑plug event coincides with an active graphics‑memory mapping. Because the trigger requires a device being unplugged while in use, the attack vector is most likely local or involves control over the hardware. The CVSS score is 5.5, indicating moderate severity. The EPSS score is not available and the flaw is not listed in CISA’s KEV catalog, indicating limited known exploitation. Nevertheless, the severity of a kernel panic warrants a high priority response. Based on the description, it is inferred that an attacker with physical or device‑control capability could exploit this to cause a denial‑of‑service on the target system.