The kernel contains a flaw in the i740fb framebuffer driver’s probe routine. When an error occurs during initialization, the memory allocated for the modelist, which is created by fb_videomode_to_modelist(), is not released. This results in a kernel memory leak that can accumulate with repeated errors, potentially exhausting kernel address space and destabilizing the system. The weakness is classified as CWE-772, reflecting a missing release of allocated resources.

All Linux kernel builds that include the i740fb framebuffer driver before the commit that added a call to fb_destroy_modelist() on error paths are affected. The advisory does not provide specific kernel version numbers; any kernel containing the unpatched driver prior to that commit remains vulnerable.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of <1% suggests a low probability of exploitation. The CVE entry does not specify the attack vector or necessary privileges. It is inferred that the flaw is exposed during device probing, which would require the system to process an i740fb device or compatible emulation; it may also require elevated privileges to repeatedly trigger the probe. Because the description and metrics do not confirm public exploitation, the overall risk is considered modest, and direct exploitation is unlikely at present.