The vulnerable code leads to memory allocated for pagerefs in fb_deferred_io_init() not being freed if an error occurs in broadsheetfb_probe(). This leaves allocations lingering. A local attacker could repeatedly trigger probe failures, consuming kernel memory until the system is forced to throttle or reboot. This is a CWE‑772 Unreleased Resource and can compromise availability, potentially affecting system stability but does not directly expose data or allow arbitrary code execution.

All Linux kernel builds whose in‑tree framebuffer driver contains the broadsheetfb implementation, prior to the commit that adds a cleanup call. No specific version range was provided in the CNA data; the commit that introduces the mitigation can be found in the provided references. Systems running a kernel older than the patch are potentially vulnerable.

Because the vulnerability requires a fault in a framebuffer device operation, the likely attack vector is local privileged or requires access to the /dev/fb* devices. The CVSS score of 5.5 indicates moderate severity, and the EPSS score is below 1%, with no listing in CISA KEV. This suggests the risk is moderate and would mainly allow denial‑of‑service through resource exhaustion rather than confidentiality or integrity compromise. An attacker who can trigger the probe path repeatedly could exhaust kernel memory or cause paging thrashing, degrading performance or forcing an OOM kill.