The vulnerability arises from an out‑of‑bounds array access that occurs during the registration of the last two outputs on the Microchip MPFS‑CCC clock controller. The driver incorrectly allocates space only for certain PLL outputs while the identifier list includes additional DLL outputs that are not supported. This mismatch allows a write beyond the allocated bounds, which can corrupt kernel memory and lead to a crash or other unstable behavior. The defect is detected by UBSAN but is not publicly exploitable without further context, and it does not provide direct code execution capability.

All Linux kernel binaries that compile the microchip MPFS‑CCC clock driver and load the associated hardware controller. The affected code resides in the clk subsystem for Microchip devices; therefore any Linux system that uses this specific clock controller is potentially impacted, regardless of distribution. No specific kernel release range is listed in the CNA data, so all current kernels that include the unpatched code are vulnerable.

A CVSS score is not provided in the CVE data, and no EPSS value is available, so the numeric risk assessment is unknown. The bug is a classic out‑of‑bounds write (CWE‑125), which can result in denial of service by causing a kernel panic. The exploitability requires the kernel to be running the unpatched driver and the attacker to be able to trigger the registration of the offending output IDs, which may be limited to privileged users or system initialization. The issue is not listed in the CISA KEV catalog, suggesting no known or documented exploits at this time.