The vulnerability occurs in the Linux kernel’s NVIDIA framebuffer driver. During device probe, the code allocates memory for a modeline list but does not release that memory on error paths. The result is a kernel‑level memory leak that can accumulate over time. The leak is limited to the local system and does not provide remote code execution or privilege escalation. This flaw represents a resource exhaustion issue typical of a memory leak.

All Linux kernel builds that include the nvidiafb framebuffer driver are potentially affected. The advisory does not specify a kernel version range, so any kernel that has not incorporated the internal patch that frees the modeline list when probe fails may be vulnerable. Users should verify whether their running kernel contains the fix or whether the nvidiafb module is loaded.

The CVSS score of 5.5 indicates medium severity, and the EPSS score is less than 1 %, suggesting a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local; an attacker would need to trigger the driver during device initialization, which typically occurs when the nvidiafb module loads. No public exploits are known, so the risk mainly applies to environments that use the NVIDIA framebuffer and could experience gradual memory exhaustion if the leak repeats.