The Linux kernel function fsl_mc_get_endpoint() returns a MAC endpoint device and stores it in mac->mc_dev. When a MAC is disconnected only the MAC and its dpaa2_mac object are freed, but the stored device reference is never released. Each successful connection therefore leaves a dangling reference, leaking kernel memory, constituting a resource exhaustion flaw (CWE-772). This leak can accumulate over time and potentially degrade kernel stability or availability.

The vulnerability affects all releases of the Linux kernel that include the dpaa2-switch driver. No specific version range is provided, so any kernel containing the dpaa2_switch implementation before this fix is potentially impacted.

The primary risk is benign resource exhaustion; there is no evidence of direct privilege escalation or remote code execution. EPSS score of <1% and the vulnerability is not listed in the CISA KEV catalog, indicating a low visibility of active exploitation. An attacker would need local kernel or privileged access to trigger the disconnect protocol, and repeated usage could lead to memory pressure. While the likelihood of exploitation is modest, the cumulative effect could affect availability on systems with frequent MAC connect/disconnect operations. The CVSS score of 4.1 reflects a low overall severity.