A flaw in the Linux kernel driver for sparx5 causes a NULL pointer dereference when the driver is removed if PTP (Precision Time Protocol) initialization was skipped. The deinitialization routine attempts to purge and unregister PTP clocks that were never set up, resulting in a kernel oops. This crash prevents the system from continuing to run and can be triggered whenever the device driver is unbound or removed, offering a local denial‑of‑service surface.

Linux kernel builds containing the sparx5 driver, typically used in network interfaces based on the MCHP SPARX5 chipset. The vulnerability affects all kernel versions before the commit that added an early return in sparx5_ptp_deinit. It applies to any distribution that ships the affected kernel without the patch.

The CVSS score of 4.4 indicates a moderate impact. The EPSS score of <1% indicates a very low probability of exploitation, and the flaw is not listed in CISA KEV, indicating no known widespread exploitation yet. The attack vector is likely local and requires the ability to remove or reload the sparx5 driver, which could be achieved by a privileged process or by misconfiguration of device drivers. The severity of a kernel oops suggests a high impact if exploited, though the lack of a public exploit reduces immediate risk.