The flaw stems from the framebuffer console subsystem, where fbcon_new_modelist() assumes that any console with a display mode set has associated vc_data. When vc_data is NULL, the function ultimately dereferences the null pointer in fbcon_set_disp(), causing a kernel panic. This null‑pointer dereference is a classic example of CWE‑476 and results in an availability impact by crashing the entire operating system.

All Linux kernel releases that include the fbcon subsystem and do not incorporate the remedial commit (5fae9a9, 6617df8, 8e9b8b0, 9b783b7, ac97035, b134ad2, cc4382d) are susceptible. Because the affected product is the generic Linux kernel, this flaw potentially affects every distribution that ships with a pre‑patched kernel version.

The CVSS score of 5.5 indicates a moderate severity. The EPSS score of < 1% indicates a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog, indicating that it is not currently a known exploited vulnerability. The flaw requires triggering a framebuffer mode change on a console that lacks vc_data, which in practice would likely necessitate either local physical or privileged access to the system. If such access exists, an attacker could induce a kernel panic and achieve a denial of service. While widespread remote exploitation is not documented, the availability impact remains significant for affected hosts.