An unfreed memory allocation in the tdfxfb_probe() routine causes a kernel memory leak when the CONFIG_FB_3DFX_I2C option is enabled. The leak occurs because fb_videomode_to_modelist() allocates memory that is not released on error paths, potentially leading to gradual kernel memory exhaustion and system instability.

All Linux kernel releases that include the tdfxfb driver with the CONFIG_FB_3DFX_I2C configuration enabled are affected. The issue was fixed by adding a call to fb_destroy_modelist() in the error handling path of tdfxfb_probe().

The EPSS score is not available, and the vulnerability is not listed in CISA KEV. Exploitation is limited to local environments where a user can trigger tdfxfb_probe(), such as during framebuffer initialization. The primary risk is resource exhaustion and denial of service; no direct confidentiality or integrity impact is documented.