In the Linux kernel, the following vulnerability has been resolved:
net: dsa: microchip: Don't free uninitialized ksz_irq
If something goes wrong at setup, kszirqfree() can be called on uninitialized kszirq (for example when kszptpirqsetup() fails). It leads to freeing uninitialized IRQ numbers and/or domains.
Use dsaswitchforeachuserportcontinue_reverse() in the error path to iterate only over the fully initialized ports.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68338.json"
}