A reference‑count leak in the Linux mlxsw driver causes the function that replaces virtual routing tables to retain references to a new tree object even after failure. The rollback loop decrements the index but never updates the VR pointer, so the same VR is repeatedly processed and the earlier VRs are never rolled back. The leaked reference prevents the new_tree object from being released, leading to gradual depletion of kernel reference‑count resources. This can degrade system stability and, after many failures, lead to resource exhaustion and a denial of service.

The vulnerability affects any Linux kernel that includes the mlxsw switch driver. All installations that run this driver in their kernel are potentially affected until the kernel includes the fix that reinitializes the VR pointer in the error loop. No specific kernel versions are listed, so users of the latest stable releases with the patch are safe.

The CVSS score of 5.5 and the EPSS score of < 1%, but the vulnerability is not listed in CISA KEV and no public exploits are known. The attack vector is inferred to be local, requiring the ability to trigger the vulnerable replacement routine through the mlxsw driver – typically privileged users or processes that interact with the switch hardware. While the issue does not grant immediate code execution, repeated failures could lead to resource exhaustion, presenting a moderate risk to availability.