The Linux kernel's fbdev subsystem currently allows concurrent readers and writers to access the mode list and mode pointer without holding the necessary lock. This unsynchronized access can lead to a use‑after‑free condition where a thread dereferences a freed modelist entry or writes a stale pointer into fb_info->mode. As a result, kernel memory can be corrupted, enabling an attacker to alter kernel data structures or execute arbitrary code with elevated privileges.

Any Linux kernel installation that has not applied the patch addressing this race condition is vulnerable. The fix involves serializing mode sysfs operations by acquiring lock_fb_info() for read and write paths and adjusting the order of operations to avoid double‑locking. The affected component is the fbdev (frame buffer device) driver; distributions deploying kernel versions prior to the commit 061db6b7a910b8378f3b2df64f8c0a3ddc6e85f2 are impacted.

The CVSS score is not provided in the available data and the EPSS score is unavailable, so risk assessment must rely on the nature of the vulnerability. Because this is a kernel-level race that can corrupt memory, an attacker with local or remote code execution capabilities (depending on circumstances) could leverage it to elevate privileges. The lack of a KEV listing implies no known mass exploitation yet, but the severity appears high due to kernel involvement. Administrators should treat this as a high‑risk issue pending patch deployment.