A memory allocation performed by the fbdev metronomefb driver’s probe routine can leak pageref structures when an error occurs. The leaked pagerefs remain in the kernel heap, gradually consuming kernel memory. The imbalance is unrelated to privilege escalation or code execution; it is purely a memory‑management flaw classified as CWE‑772, leading to potential denial of service through resource exhaustion.

Any Linux kernel configuration that includes the fbdev metronomefb driver and has not applied the commit that cleans up the pageref allocation is affected. Typical usage includes the driver being loaded automatically during boot or manually via module insertion. The vulnerability applies to all built‑in kernels until a kernel update that incorporates the fix is deployed.

The recorded CVSS score of 5.5 reflects a moderate impact, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Local exploitation would likely require a process that can trigger the driver’s probe routine repeatedly, such as a privileged user or a compromised application that initiates the module. An attacker could force successive failures, causing progressive kernel memory exhaustion and potentially destabilizing the system. Remote exploitation is not supported by the current description.