The vulnerability arises in the Linux kernel’s framebuffer driver for NVIDIA graphics hardware. During initialization, the function nvidiafb_probe allocates memory for a modeline list that is never released on error paths. This omission can cause a memory leak, gradually consuming kernel memory. Over time, the leak can exhaust available memory, potentially causing the kernel to OOM-kill processes or become unresponsive, thereby degrading system availability. The flaw is a classic resource exhaustion problem and is classified as a memory leak. No known privilege escalation or remote code execution capability is associated with this issue.

All installations of the Linux kernel that include the NVIDIA framebuffer driver are impacted. No specific kernel version range is listed in the advisory, so any kernel build incorporating the unpatched code may be vulnerable. Users running modern distributions should verify whether their kernel has incorporated the internal patch to the nvidiafb driver.

The exploitability of the defect is low because it requires privilege as the code runs in kernel mode and needs to be triggered during device initialization. No public exploits exist, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. The risk is limited to denial of service in environments that load the NVIDIA framebuffer and can exhaust memory if the leak is repeated or compounded. Adversaries would have to gain local access to the system to trigger the bug or rely on a hardware change that forces a reload of the driver.