fbdev: vfb: defer cleanup until the last reference describes a kernel‑level use‑after‑free in the Linux framebuffer driver. When an FBIOGETCMAP ioctl reads a shallow snapshot of info->cmap after releasing info->lock, the vfb_remove() routine immediately frees the colormap memory, even if an open file descriptor still holds a reference to the framebuffer object. This allows a concurrent driver unbind to free the colormap while the ioctl performs a _copy_to_user, resulting in a slab‑use‑after‑free and a fault as reported by KASAN.

Any Linux kernel installation that includes the vfb (virtual framebuffer) driver and has not applied the fix. The CVE lists the kernel generically, so all distributions using the upstream kernel with the vfb module are potentially affected. Version information is not supplied, so the exact range is unspecified.

CVSS score 5.5 indicates moderate severity, and the EPSS score < 1% shows a very low likelihood of exploitation at the time of this analysis. The vulnerability is local, requiring the attacker to access an open /dev/fb* device and trigger removal of the vfb driver while an ioctl is executing. Based on the description, it is inferred that an attacker with local access could cause a kernel panic or memory corruption, which might enable privilege escalation, although no explicit proof or exploit is provided. The vulnerability is not listed in CISA’s KEV catalog.