CVE-2022-49419

A use-after-free vulnerability exists in the Linux kernel's VESA framebuffer (vesafb) driver, stemming from improper memory management during device removal. Specifically, the fb_info structure, which holds framebuffer device information, is prematurely freed in the .remove handler instead of the .fb_destroy callback. This misordering can lead to scenarios where the .fb_destroy function is invoked before .remove, resulting in the fb_info pointer being accessed after it has been freed.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.