The Linux macb network driver registers fixed rate clock objects through clk_register_fixed_rate() but does not unregister them when the driver or interface is disabled, causing kernel resources to be lost. This flaw results in a gradual leak of clock resources, potentially leading to kernel resource exhaustion over extended periods. The vulnerability is a classic resource leak; it does not provide immediate code execution or privilege escalation capabilities.

All versions of the Linux kernel that contain the macb driver and perform fixed rate clock registrations prior to the application of the commit that added clk_unregister_fixed_rate() are affected. The issue applies to the generic Linux kernel package; vendor‑specific names are not required.

The vulnerability is a classic resource leak (CWE-772). EPSS score <1% and the vulnerability is not listed in CISA KEV, indicating no known public exploitation. The likely attack vector is local or privileged: an attacker would need to unload and reload the macb driver, or repeatedly enable and disable the network interface, to trigger the clock registration and provoke resource loss. Because the leak accumulates over time, the risk is moderate; a system could become unstable after sustained or repeated driver activity. The CVSS score of 5.5 quantifies its medium severity, and while the impact is confined to resource exhaustion, it could lead to denial‑of‑service if left unpatched.