In the Linux kernel, initializing the MPFS driver allocates a sys_controller structure. If the call to of_get_mtd_device_by_node fails, the function returns without freeing the allocation, creating a memory leak. Over time, repeated failures can exhaust kernel memory, potentially causing a kernel panic or degraded performance. This flaw is a resource‑exhaustion vulnerability (CWE‑772) and does not give an attacker code execution or data disclosure capabilities.

Any installation of the Linux kernel that incorporates the Microchip MPFS system controller driver is affected. The vulnerability is not tied to a specific kernel version; therefore, all kernels that still contain the vulnerable code should be updated. Administrators should verify whether their deployments include MPFS support and whether the recent patch commit has been applied.

The EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, indicating a low likelihood of exploitation. Based on the description, the likely attack vector is local and would require an attacker who can trigger the driver’s initialization with a device tree node that causes of_get_mtd_device_by_node to fail. The impact is limited to service availability, with no data compromise or privilege escalation. The resource exhaustion could affect overall system stability, so the risk is moderate but the recommended response is prompt patching.