The reported issue is a memory leak in the i740fb framebuffer driver within the Linux kernel. During the probe phase, a memory block allocated for the modelist structure is not freed on error paths, leading to unreleased kernel memory. Repeated or continuous exploitation could deplete kernel address space, causing system instability or crashes. The vulnerability is classified as worth a CWE-401 (Improper Release of Memory).

All Linux kernel releases that contain the i740fb framebuffer driver and have not yet incorporated the public fix commit. The specific kernel versions are not enumerated in the advisory, but any kernel entry that includes i740fb before the commit date is potentially affected.

The EPSS score is unavailable and the vulnerability is not listed in CISA KEV, indicating no confirmed widespread exploitation. Because the flaw resides in a low‑level driver that only reacts during hardware initialization, the attack vector is limited to systems with an i740fb device present or accessible through device emulation, and would likely require physical or privileged access to trigger repeated probes. Consequently, the risk is moderate; while exploitation could lead to a denial of service, it is not currently observed or documented.