The sm501fb framebuffer driver in the Linux kernel incorrectly handles the frame buffer mode string obtained from the device tree. The driver writes this string into a fixed buffer without checking its length, leading to a buffer overrun. Additionally, the driver frees context structures in multiple places, resulting in use‑after‑free and memory leaks. These bugs cause kernel memory corruption and could corrupt data structures that the kernel uses for critical operations.

All Linux kernel releases that include the sm501fb fbdev driver and load the driver via device tree bindings containing CRT or PANEL settings are affected. The vulnerability exists in any kernel prior to the commits referenced in the advisory, regardless of distribution patch level.

The CVSS score of 5.5 indicates a medium severity vulnerability, and the EPSS score is under 1%, reflecting a low expected exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. A local attacker or an entity that can modify the device tree used during boot may potentially trigger the overrun or use‑after‑free paths. The likely attack vector is manipulation of the OF mode string or probe path, but this inference is not explicitly stated in the CVE data; it follows from the description of the flawed code.