The flaw occurs in the Linux kernel’s microchip Distributed Switch Architecture driver during PTP message interrupt setup. If request_threaded_irq() fails, the freshly created IRQ mapping is not freed – the error path only frees mappings that were successfully set up. The orphaned mapping leaves a dangling resource, which can lead to resource exhaustion and a potential denial of service.

All Linux kernel versions containing the microchip DSA driver before the commit that introduces the fix are affected. Any distribution running such a kernel without the patch is at risk. The affected code path is present in the mainstream kernel series and in recent release candidates such as 7.0 rc1 through rc3.

The CVSS score of 5.5 classifies this issue as medium severity. An EPSS score of less than 1% indicates a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog and no publicly known exploit exists. Exploitation would require an attacker to repeatedly trigger failures during PTP IRQ setup, which typically demands privileged or highly targeted network activity. If achieved, the attacker could drain IRQ mapping or other system resources, causing a denial of service, but no remote code execution is possible.