Riskcovery

CVE-2025-68338

net: dsa: microchip: Don't free uninitialized ksz_irq

State
Published
Severity
Not scored
Published
Dec 23, 2025
Updated
May 11, 2026
Reserved
Dec 16, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

net: dsa: microchip: Don't free uninitialized ksz_irq

If something goes wrong at setup, ksz_irq_free() can be called on uninitialized ksz_irq (for example when ksz_ptp_irq_setup() fails). It leads to freeing uninitialized IRQ numbers and/or domains.

Use dsa_switch_for_each_user_port_continue_reverse() in the error path to iterate only over the fully initialized ports.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • cc13ab18b201ab630f03511060ba289b70052959 to before 9428654c827fa8d38b898135d26d39ee2d544246Affected
  • cc13ab18b201ab630f03511060ba289b70052959 to before 32abbcf4379a0f851d7eb9d4389e7bf5c64bf6c0Affected
  • cc13ab18b201ab630f03511060ba289b70052959 to before 25b62cc5b22c45face094ae3e8717258e46d1d19Affected
LinuxLinux
  • 6.3Affected
  • before 6.3Not affected
  • 6.12.61 through 6.12.*Not affected
  • 6.17.11 through 6.17.*Not affected
  • 6.18 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.