CVE-2025-68338: net: dsa: microchip: Don't free uninitialized ksz_irq
In the Linux kernel, the following vulnerability has been resolved:
net: dsa: microchip: Don't free uninitialized kszirq
If something goes wrong at setup, kszirqfree() can be called on uninitialized kszirq (for example when kszptpirqsetup() fails). It leads to freeing uninitialized IRQ numbers and/or domains.
Use dsaswitchforeachuserportcontinuereverse() in the error path to iterate only over the fully initialized ports.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68338?
CVE-2025-68338 has been classified with moderate severity due to the potential for a system crash from freeing uninitialized resources.
How do I fix CVE-2025-68338?
To fix CVE-2025-68338, update the Linux kernel to the latest stable version where this vulnerability has been addressed.
What is the impact of CVE-2025-68338 on system stability?
CVE-2025-68338 can lead to system instability and crashes if the uninitialized resource is accessed improperly.
Which versions of the Linux kernel are affected by CVE-2025-68338?
CVE-2025-68338 affects specific versions of the Linux kernel that utilize the DSA microchip driver.
Is there a known exploit for CVE-2025-68338?
As of now, there are no widely reported exploits specifically targeting CVE-2025-68338.