The flaw is a memory leak caused by an incorrect goto label in the uvesafb_vbe_init() function of the Linux kernel’s framebuffer driver. When specific error paths occur during module initialization, the memory allocated for modedb and modelist is not freed, which can cause the system to exhaust kernel memory and become unstable or crash. This represents a denial‑of‑service condition and corresponds to CWE‑772.

The vulnerability affects any Linux kernel build that includes the uvesafb framebuffer driver. The fix is contained in several kernel commits (033e56f, 12fe6a5, 61d46d6, 8198592, aa387a3, c53fdf7, c606c28, f413512). Because specific distribution versions are not enumerated, any distribution using a kernel prior to these commits is potentially affected until the patch is installed.

The EPSS score is less than 1 %, indicating a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score is 5.5. Based on the description, exploitation would require local access and a privileged process capable of re‑initializing the framebuffer module. Repeated triggering could deplete kernel memory, but the overall risk remains low due to the low EPSS, though unpatched systems that load uvesafb are still at risk.