In the Linux framebuffer subsystem, the defio component tracks deferred I/O state through a structure tied to the lifetime of a fb_info instance. When a device is hot‑unplugged while user space still keeps an active mapping of the device’s graphics memory, the kernel frees the fb_info but does not immediately clean the deferred I/O mapping. Later cleanup clears a pointer inside the state, so any subsequent access dereferences a dangling pointer and results in a SIGBUS termination of the kernel. This is a classic use‑after‑free flaw that forces a kernel crash, disrupting system availability but does not grant arbitrary code execution.

All Linux kernel releases that contain the vulnerable fbdev defio implementation before the fix referenced by commit 25c2b77bc463f29ee71a54b883548baf9386a0db are affected. The flaw exists in the vanilla kernel and any downstream derivation that has not merged the commit, regardless of distribution or architecture.

The vulnerability leads to an uncontained kernel crash when a hot‑plug event coincides with an active graphics‑memory mapping. The CVSS score of 7.8 indicates high severity, while the EPSS score of <1% reflects a very low but nonzero probability of exploitation. The flaw is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the principal attack vector requires local or device‑control access; an attacker with the ability to trigger a hot‑unplug while a user‑space mapping exists could cause a denial‑of‑service on the target system.