A flaw in the Radeon framebuffer initialization routine causes dynamically allocated video mode list entries to remain in memory when the driver encounters an error while registering the device. Because the allocated memory is never released in these error paths, repeated failures can gradually consume kernel memory, potentially exhausting resources and degrading system performance or triggering a crash. The flaw does not provide direct remote access or privilege escalation; its impact is confined to local users who can load or interact with the driver.

The issue exists in all versions of the Linux kernel that include the Radeon framebuffer driver prior to the recent patch. Systems running any Linux distribution that ship an unpatched kernel with Radeon GPU support are affected. No specific version ranges are listed in the advisory, so all kernels before the fix are potentially vulnerable.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of <1% reflects a very low exploitation probability. The patch was incorporated as an in‑kernel change, so exploitation requires driver load during system boot or module insertion and thus is limited to local users with sufficient privileges to load kernel modules. The vulnerability is not listed in CISA’s KEV catalog, and no known public exploit or exploit evidence is reported. Based on the description, it is inferred that the attack vector is local, kernel‑level privilege. The primary risk is resource exhaustion leading to a denial‑of‑service if the situation repeats frequently or if heavy memory usage is present. Because the flaw does not involve user‑controlled input or external interfaces, the threat surface is small and unlikely to be leveraged for other attacks.