The Linux kernel's Microchip PolarFire SoC system controller driver contained a memory leak vulnerability in the mpfs_sys_controller_probe() function. Specifically, if the call to of_get_mtd_device_by_node() failed, the function returned immediately without freeing the allocated sys_controller memory, leading to a memory leak. The fix involves redirecting error handling to a common label that frees allocated memory properly. This vulnerability is part of a broader set of Linux kernel security fixes addressing multiple subsystems and architectures. The issue affects Linux kernel versions prior to 6.8.0-1064.72 and related builds. The CVSS 3.1 vector indicates local attack vector with low complexity, requiring low privileges, no user interaction, unchanged scope, no confidentiality or integrity impact, but with high impact on availability.

The vulnerability causes a memory leak in the kernel driver, which can degrade system stability or availability over time. There is no direct impact on confidentiality or integrity. The CVSS score of 5.5 reflects a medium severity primarily due to the potential availability impact. No known exploits in the wild have been reported.

A patch is available and has been released by the vendor. Users should apply the official Linux kernel updates that include this fix. After updating, a system reboot is required to activate the patched kernel. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be necessary. Follow the vendor advisory instructions for updating and rebuilding kernel modules as needed.