A reference to the PTP PCI device is obtained during the ThunderX NIC driver initialization and is not released if subsequent initialization steps fail. This reference leak can increase the device’s reference count indefinitely, potentially exhausting kernel resources or destabilizing the system, which may lead to a denial‑of‑service if repeated probe failures occur.

Linux kernel builds that include the ThunderX network driver with PTP support are affected. Any kernel module using this driver before the upstream patch is applied may be vulnerable. The specific kernel versions are not listed, so all installations of the driver prior to the fix are at risk.

The CVSS score of 2.3 and an EPSS score of < 1% indicate a low likelihood of exploitation. Based on the description, it is inferred that the likely attack vector is local, as a user with sufficient privileges could trigger probe failures or influence device initialization to cause the reference leak. The vulnerability is not listed in CISA’s KEV catalog, indicating no publicly known exploits. The risk is considered low to moderate, primarily limited to local execution that can trigger forced probe failures. An attacker would need sufficient privilege to influence device initialization or repeatedly trigger probe failures to deplete kernel resources.