The carminefb framebuffer driver allocates a mode list in fb_videomode_to_modelist() but does not free this memory when an allocation failure occurs during alloc_carmine_fb(). The result is a memory leak that can persist for each failed allocation. As memory leaks accumulate, system resources may be exhausted, potentially degrading host performance or leading to failed processes. The CVE description does not explicitly state a denial‑of‑service outcome, but a long‑running leak could theoretically cause service disruption.

Linux kernel builds that include the carminefb framebuffer driver are impacted. No specific kernel release numbers are provided, so any kernel containing this driver without the subsequent patch may be vulnerable. The vulnerability is confined to the driver code and does not extend to other kernel subsystems.

The EPSS score is reported as < 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 5.5 reflects moderate severity. Based on the description, it is inferred that an attacker would need local access and sufficient privileges to trigger the allocation failure—such as the ability to load or interact with the driver module. No public exploit is currently documented, so the practical risk remains low for most moderate‑impact environments.