During probe of the CPSW driver, the devlink framework registers a device before the CPSW ports are registered. If the port registration fails, the cleanup path unregisters only the notifiers and releases lower‑level resources but forgets to undo the successful devlink registration. The stray devlink instance remains registered, leaving its parameters bound to a nonexistent port. This residual registration can consume kernel resources and leave the network stack in an inconsistent state, potentially leading to degraded performance, improper network configuration, or a denial of service.

All Linux kernel installations that use the cpsw_new driver are affected. The vendor is Linux and the product is the Linux kernel. No specific version ranges are supplied, so all current kernels that include the cpsw_new driver path are potentially vulnerable until the fix is applied.

The CVSS score of 1.9 indicates low severity. The EPSS score of <1% suggests a very low likelihood of exploitation. The vulnerability is not listed in CISA KEV. The flaw is local to systems that load the cpsw_new driver; it would require the attacker to trigger a port registration failure, which generally implies control over device firmware or hardware or the ability to reboot the system. No public exploits have been disclosed, so the risk is moderate but the impact could be significant if the driver is repeatedly forced into the failure path.