The vulnerability resides in the Linux kernel’s microchip Distributed Switch Architecture (DSA) driver. During PTP message interrupt setup, if request_threaded_irq() fails, the newly allocated IRQ mapping is not freed. The error path only cleans up mappings that succeeded, leaving dangling resources. This oversight can lead to an unreleased resource condition, potentially exhausting kernel memory or IRQ table entries and causing a denial of service.

Systems running Linux kernel versions that include the microchip DSA driver but lack the patch found in commit 3704ac6a0d9a78f66a187515a8ca3faedaf01cc5. The bug is present before the kernel release that implements the fix; all affected distributions need to update to a kernel containing the patch.

The fix improves resource cleanup; no CVSS score is publicly available and the EPSS score is not provided, indicating low publicly documented exploitation risk. The vulnerability is not listed in the CISA KEV catalog, and no known exploit has been reported. An attacker would need the ability to trigger PTP IRQ setup failures repeatedly, which typically requires privileged or targeted network activity. If successfully exploited, the attacker could exhaust IRQ mappings leading to service disruption, but no remote code execution is possible.