In the Linux kernel, a flaw in the dpaa2 switch driver mismanages forwarding database (FDB) instances when a port leaves a bridge. When the last port departs from one bridge, the driver insists on reusing an unused FDB instead of correctly marking the previous one as unused. As a result, multiple ports that belong to different bridges but share the same Digital Physical Switch (DPSW) instance may end up referencing the same FDB. This sharing can cause traffic routed to one port to appear on another and can expose data between unrelated network segments, representing a risk to confidentiality and integrity. The weakness is an example of improper reinitialization of a critical driver resource and is classified as CWE‑665.

The vulnerability affects the Linux kernel’s dpaa2 switch driver. No specific kernel versions were listed in the data, so all kernel releases that include the affected driver component are potentially impacted until the patch is applied. The issue is tied to the dpaa2 switch port handling logic within the Linux networking stack.

The CVSS score is not listed, and the EPSS score is not available, but the vulnerability is tracked and not yet part of the CISA KEV catalog. The attack would most likely involve a user or process with the ability to cause a port to leave its bridge, such as reconfiguration of networking or a defective hardware driver. Once the condition is met, traffic could be misrouted or leaked between bridges. Because the issue requires a state change in bridge membership, it is not trivially exploitable without privileged or sufficient network control. Nonetheless, systems that rely on dpaa2 switching should treat it as a moderate‑to‑high risk until patched.