A race condition exists between the framebuffer mmap function and the OMAPFB_SETUP_PLANE ioctl. The mmap path reads information from the new memory region while incrementing a reference count on an older region. Concurrently, the ioctl can reassign the region and free the old one, leaving a userland process with a mapping to physical memory that has already been freed. This use‑after‑free flaw is a memory‑management weakness (CWE‑825) that can lead to arbitrary kernel memory corruption and, because it occurs in a privileged subsystem, may be leveraged for privilege escalation.

All Linux kernel releases that ship the unpatched omapfb driver are affected. The flaw resides in the framebuffer subsystem’s omapfb_mmap() implementation for OMAP devices. No specific kernel version range is supplied in the CVE data; thus any kernel containing the legacy driver that has not applied the recent fix is at risk.

The CVSS score of 7.8 indicates high severity, while the EPSS score of less than 1 % reflects a low probability of exploitation at the time of analysis. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker to trigger the race condition by simultaneously invoking the OMAPFB_SETUP_PLANE ioctl while a process performs a framebuffer mmap. The attack surface is therefore local and typically requires access to the framebuffer device, which is often restricted to privileged users or necessitates a compromised user‑space process.