The vulnerability is a memory leak in the Linux kernel framebuffer driver for S3 hardware. During the PCI device probe, allocated memory for a modelist is not released on error paths. This flaw can allow an attacker with local system privileges to repeatedly trigger the probe routine, resulting in gradual exhaustion of kernel memory and degradation or crash of the entire system.

The issue resides in the Linux kernel, specifically in the s3fb framebuffer driver. No particular kernel version is listed in the data, but the patch was added in recent kernel commits for the Linux kernel. Systems that run a Linux kernel containing the s3fb driver and that have not yet incorporated the fix are potentially affected.

Because the vulnerability requires local execution and is limited to the kernel’s framebuffer code, its exploitation is constrained to systems with privileged access. However, repeated memory leaks could lead to a denial‑of‑service condition. The CVSS score is not provided, the EPSS score is unavailable, and the vulnerability is not listed in CISA's KEV catalog. These factors suggest a moderate to high risk for systems where the attacker can invoke the probe routine frequently and where kernel memory is limited.