The vulnerability arises in the Linux kernel’s fbdev subsystem where a sysfs output function, mode_string(), uses snprintf without bounds checking. The function can return a length larger than the remaining buffer space, and the caller, show_modes(), accumulates this length without verifying that the running offset remains within the page boundary. As a result, if the modelist is long enough, the output offset may advance past the sysfs buffer causing an out‑of‑bounds write, which can corrupt kernel memory or trigger a kernel panic, thereby providing a denial‑of‑service vector.

Affected systems are Linux kernel installations that have not yet incorporated the patch introducing scnprintf bounds enforcement. All kernel releases containing the fbdev sysfs mode output feature and lacking the corrective changes are potentially vulnerable, with no specific version range specified.

Based on the description, the attack vector is likely local user‑level access to the /sys/class/.../modes sysfs entry. An attacker may induce a large mode list to trigger the overflow, leading to kernel memory corruption or a crash. The EPSS score is below 1% (approximately 0.00112), and the vulnerability is not listed in CISA KEV. Nevertheless, the potential for a kernel panic or arbitrary memory write makes it a high‑severity flaw once the vulnerable kernel is in use.