In the Linux kernel, the vesafb driver’s probe routine allocates a string of option data that the caller is expected to free. However, vesafb_probe never releases this memory, creating a kernel memory leak. Over time, repeated driver initialisation can exhaust available kernel memory, potentially causing an out‑of‑memory condition or system crash. This flaw does not grant arbitrary code execution but can degrade system availability. The weakness maps to CWE-772.

The affected product is the Linux kernel with the vesafb framebuffer driver. All kernel versions prior to the commit that added the free() call (73ce73c30ba9) are vulnerable. Distributions that ship the default kernel with vesafb enabled and have not applied this patch are at risk. The specific product is not tied to a vendor beyond the Linux kernel itself, and no version range is explicitly listed, so all kernels before the commit are potentially impacted.

The vulnerability was addressed by an in‑kernel patch that adds a missing free() call. The CVSS score of 5.5 indicates moderate severity, and the EPSS score of < 1% suggests a low exploitation likelihood. The memory leak can lead to resource exhaustion. The likely attack vector is local or privileged access, and based on the description, it is inferred that the attacker would need to force repeated initialisation of vesafb to drain kernel memory. An attacker with physical or privileged access could induce many initialisations, leading to a denial of service. The flaw is not listed in CISA KEV, but its potential to bring down a system warrants attention.