The vulnerable code leads to memory allocated for pagerefs in fb_deferred_io_init() not being freed if an error occurs in broadsheetfb_probe(). This leaves allocations lingering. A local attacker could repeatedly trigger probe failures, consuming kernel memory until the system is forced to throttle or reboot. This is a CWE‑401 Memory Leak and can compromise availability, potentially affecting system stability but does not directly expose data or allow arbitrary code execution.

All Linux kernel builds whose in‑tree framebuffer driver contains the broadsheetfb implementation, prior to the commit that adds a cleanup call. No specific version range was provided in the CNA data; the commit that introduces the mitigation can be found in the provided references. Systems running a kernel older than the patch are potentially vulnerable.

Because the vulnerability requires a fault in a framebuffer device operation, the likely attack vector is local privileged or requires access to the /dev/fb* devices. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV. The missing CVSS score and lack of published exploitation evidence suggest the risk is moderate; it would mainly allow denial‑of‑service through resource exhaustion rather than confidentiality or integrity compromise. An attacker who can trigger the probe path repeatedly could exhaust kernel memory or cause paging thrashing, degrading performance or forcing an OOM kill.