Executive brief
A resource management issue was identified in the Linux kernel's Microchip network driver. When the system fails to set up certain internal communication signals (PTP IRQs) for network switches, it fails to properly clean up temporary memory mappings. While this is a minor technical flaw, it could lead to inefficient resource usage or system instability in specific error scenarios during hardware initialization.
Technical details
A resource leak vulnerability exists in the Microchip KSZ DSA driver within the Linux kernel. Specifically, in the ksz_ptp_msg_irq_setup() function, an IRQ mapping is created using irq_create_mapping(). If the subsequent call to request_threaded_irq() fails, the function returns an error without calling irq_dispose_mapping(). This results in a leaked IRQ mapping. An attacker with local access or the ability to trigger hardware initialization errors could potentially exploit this to cause resource exhaustion. The issue has been resolved by adding the missing irq_dispose_mapping() call to the error path.
Affected products
- Linux Linux Kernel v6.1, v6.6, v6.7, v6.8
Timeline
- 2026-03-09: patched: Initial patch authored by Bastien Curutchet
- 2026-05-08: disclosed: CVE-2026-43372 published
References
- https://git.kernel.org/stable/c/3704ac6a0d9a78f66a187515a8ca3faedaf01cc5
- https://git.kernel.org/stable/c/6c58a9fdb0d0e1011aa02455d26d6ebea251979b
- https://git.kernel.org/stable/c/99c8c16a4aad0b37293cae213e15957c573cf79b
- https://git.kernel.org/stable/c/c2d1d41e0e8ec447d40a5752844fc5fb0b23db27
- https://git.kernel.org/stable/c/e80fef36c676c947072dabeb5803ae59d92ba493