A use‑after‑free occurs in the fbdev modedb component of the Linux kernel. When fb_find_mode() is called with a NULL mode_option, an internal buffer (mode_option_buf) is allocated, assigned to the name pointer, and freed while the name pointer remains in use. This flaw can corrupt memory or crash the kernel, potentially allowing a local attacker to cause denial of service or, in rare circumstances, achieve arbitrary code execution if the corruption is exploited. The weakness is classified as CWE‑825.

All Linux kernel builds that include the default framebuffer driver (fbdev) and have not yet incorporated the commit that extends the lifetime of mode_option_buf are vulnerable. The vulnerability applies to any distribution or kernel customisation that ships the stock Linux kernel with the fbdev module compiled in and has not applied the upstream fix.

The CVSS base score of 5.5 indicates moderate severity, and the EPSS score of less than 1 % implies a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, and no publicly available exploits are reported. The likely attack vector is local manipulation of the framebuffer device; an attacker with write access to /dev/fb0 or a similar interface can trigger the faulty logic. Remote exploitation is improbable without additional privilege escalation or kernel module insertion capabilities.