The dpaa2-switch driver in the Linux kernel had an out‑of‑bounds check for interface identifiers in its interrupt handler. When a boundary violation was detected, the interrupt status was not cleared, leading to repeated spurious interrupts, known as an interrupt storm. This can exhaust CPU resources, degrade performance, or render the system unresponsive, effectively a denial‑of‑service condition. The underlying weakness is captured by CWE‑392, Unchecked Input Leading to Out‑of‑Bounds Access.

Linux kernel systems that include the dpaa2‑switch driver are affected. The flaw existed in kernel releases prior to the inclusion of commit 31a7a0bbeb00, which added a bounds check and corrected the interrupt handling. Specific kernel version ranges are not listed, so any kernel build that has not integrated this commit should be considered vulnerable.

The exploitability is low, as indicated by an EPSS score of less than 1 %, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, an attacker who can trigger a bad interface identifier—most likely through malformed network traffic to the affected device—could initiate an interrupt storm and cause service disruption. The risk is therefore primarily a local denial‑of‑service, but remote exploitation via network traffic is plausible given the nature of the driver.