A memory allocation performed by the Linux kernel framebuffer driver "hecubafb" during the probe phase is not released on error paths, resulting in a kernel‑space memory leak. If the error condition is repeatedly triggered, the kernel will continue to consume page references that are never freed, which can eventually exhaust system memory and bring the system to a halt or force a reboot. This does not provide arbitrary code execution but can be used for local denial of service against privileged users or in a compromised environment. The weakness corresponds to an improper resource handling flaw (CWE-401) and an improper resource release flaw (CWE-772).

All Linux kernel installations that include the hecubafb framebuffer driver are potentially affected. No specific kernel version range is supplied in the advisory; therefore any kernel build that contains the pre‑fix code paths should be examined and updated once the patch is released. The vendor product is the Linux kernel, maintained by the Linux kernel community.

The risk of this flaw is moderate with a CVSS score of 5.5. The EPSS score is less than 1%, and the vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation yet. The flaw requires local access to trigger the probe failure and drive the memory leak; thus the attack vector is likely purely local or through a privileged kernel module load. The severity is a denial‑of‑service condition but it is not classified as a direct remote code execution or privilege escalation flaw.