In Linux kernel fbdev, calling store_modes() can replace a framebuffer’s modelist with a userspace list while still leaving pointers to the freed data. The code frees an old modelist but does not clear fb_display[i].mode or fb_info->mode, which are then used later by ioctl handlers or sysfs read functions. This use‑after‑free condition can corrupt memory and, if an attacker can control the layout of the freed memory, could lead to arbitrary code execution. The defect is formally identified as CWE‑825, which highlights unsafe pointer usage after freeing memory.

All distributions that ship the Linux kernel prior to the inclusion of commit a1f305893074 or later are affected. The vulnerability manifests in any kernel that uses the console framebuffer (fbdev) modules, regardless of vendor, because the CPE indicates the entire Linux kernel family.

The CVSS score of 7.0 indicates a high severity, but the EPSS score is documented as less than 1%, suggesting a low likelihood of widespread exploitation at present. The issue is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation requires local privilege to invoke the FBIOPUT_VSCREENINFO ioctl or to cause the console to unmap a framebuffer. Attackers would need to target systems with active framebuffer usage, making the attack vector local and privileged. Nonetheless, the severity warrants prompt remediation.