When a userspace process calls FBIOPUT_VSCREENINFO with the flag FB_ACTIVATE_INV_MODE, the kernel may delete one of the video modes from the framebuffer’s modelist. The code checks that the mode being removed is not the current mode or in use by fbcon, but it does not clear the global fb_info->mode pointer if that pointer refers to the entry being deleted. If the deleted entry is freed, subsequent reads of fb_info->mode through sysfs (show_mode()) dereference a stale pointer, causing the kernel to crash. This vulnerability is exploitable to bring the system down, leading to a denial of service.

The flaw resides in the generic Linux kernel framebuffer driver (fbdev), affecting any Linux system that runs a kernel version prior to the application of the patch described. No specific version range is provided, so the risk applies to all kernels implementing this fbdev code before the fix.

The EPSS score of <1% indicates a very low, but non‑zero probability that this vulnerability may be exploited in the wild, and the vulnerability is not listed in CISA’s KEV catalog. The CVSS score of 7.8 indicates a high severity. The likely attack path involves a userspace program with permission to write to the framebuffer device and issue FBIOPUT_VSCREENINFO; the bug allows that program to trigger a kernel panic. Because the damage manifests as a kernel crash, the impact is a denial of service. The exploitability requires the ability to manipulate framebuffer settings, which may be limited to privileged users or processes with device access, so the overall risk is moderate but could be higher if device permissions are lax.