The vulnerability lies in the efifb_probe() function of the Linux kernel’s framebuffer driver. When initializing the EFI framebuffer, the driver calls fb_get_options() to retrieve a string of option data, but it fails to free this string. This omission results in a memory leak each time efifb_probe() executes. Over time—especially on boot or when multiple EFI framebuffers are created—the accumulated leaked memory can exhaust available kernel memory, potentially causing system instability, crashes or a denial‑of‑service condition. Affected systems include any Linux kernel build that predates the fix commit 73ce73c30ba9. The kernel vendor is Linux, the product is the Linux kernel; no specific version range is listed, so every unpatched kernel version that includes the buggy efifb_probe() code is susceptible. Risk is moderate because the flaw is local; it requires the attacker to trigger efifb_probe(), which normally occurs during boot or when the framebuffer device is loaded. No CVSS score, EPSS score, or KEV listing is available, implying that the vulnerability is not widely exploited in the wild yet. Nevertheless, the memory consumption can lead to DoS, so patching or disabling the offending firmware module is recommended.

Affected systems include all Linux kernel builds before commit 73ce73c30ba9; the vendor is Linux and the product is the Linux kernel. No version range is specified, so any unpatched kernel containing the vulnerable efifb_probe() is susceptible.

The flaw is local. Each execution of efifb_probe() leaks memory. An attacker with local privileges can trigger the probe repeatedly across reboots or by reloading the framebuffer device, potentially exhausting kernel memory and causing a system crash or reboot. The lack of publicly available CVSS or EPSS scores and its absence from the KEV catalog imply this vulnerability has not yet been exploited widely. Nonetheless, the impact could be significant for high‑availability systems or unattended workstations, where a DoS could be disruptive. Exploitation requires kernel module loading and local access; it cannot be triggered remotely.