The Linux kernel contains a clock reference leak in the ma35d1 serial driver. The probe routine obtains a clock reference via of_clk_get() but does not release that reference on error paths or when the device is removed, causing the reference count to grow unchecked. Over time this can exhaust kernel resources and destabilize the system or trigger a crash, leading to a denial‑of‑service condition.

All Linux distributions that ship kernel versions which include the ma35d1 serial driver without the fix are affected. This includes stock kernels older than the commit that added the missing clk_put() calls. Systems using such kernels may experience resource exhaustion whenever the driver is probed, removed, or encounters probe errors.

The EPSS score is <1% and the vulnerability is not listed in CISA’s KEV catalog, indicating limited public exploitation data. Based on the description, the likely attack vector is local system interaction that forces the driver into probe error paths or removal—for example, by repeatedly unloading and reloading the device or by inducing probing failures. Exploitation would require local action and would result in cumulative clock reference leaks, potentially leading to resource exhaustion over time.