The vulnerability lies in the efifb_probe() function of the Linux kernel’s framebuffer driver. When initializing the EFI framebuffer, the driver calls fb_get_options() to retrieve a string of option data, but it fails to free this string. This omission results in a memory leak each time efifb_probe() executes. Over time—especially on boot or when multiple EFI framebuffers are created—the accumulated leaked memory can exhaust available kernel memory, potentially causing system instability, crashes or a denial‑of‑service condition. The CVSS score for this issue is 5.5, and the EPSS score is less than 1 %, indicating a low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation is known.

Affected systems include all Linux kernel builds before commit 73ce73c30ba9; the vendor is Linux and the product is the Linux kernel. No version range is specified, so any unpatched kernel containing the vulnerable efifb_probe() is susceptible.

The flaw is local. Each execution of efifb_probe() leaks memory. An attacker with local privileges can trigger the probe repeatedly across reboots or by reloading the framebuffer device, potentially exhausting kernel memory and causing a system crash or reboot. The CVSS score of 5.5 and an EPSS below 1 % indicate a moderate severity with a low probability of exploitation in the wild. Though it is not catalogued in KEV, the memory exhaustion could be disruptive to high‑availability systems. The lack of remote attack vectors means the vulnerability cannot be triggered remotely without local access or privilege escalation.