In the Linux kernel, a refactor that moved runtime PM enable earlier caused pm_runtime_disable() called in probe error paths to trigger duplicate clock disables. This occurs when a device’s device tree description for attached flashes is missing or broken, leading to warning messages and possible kernel instability. The vulnerability does not directly give an attacker a new capability, but it can cause unpredictable behavior in the driver stack.

All Linux kernel builds that include the cadence-quadspi driver on a kernel without the fix in commit f1eb4e792bb1 are affected. The issue arises for devices with broken or missing DT entries for the flashes used with the Cadence QuadSPI controller, regardless of distribution. Any Linux system running such a kernel and that uses that controller is potentially impacted.

The CVSS score is 5.5, indicating a moderate severity. The EPSS score is unavailable, so the overall likelihood of exploitation remains uncertain. The bug is not listed in CISA KEV catalog, suggesting no known public exploits. Exploitation would require privileged access to load a driver with a flawed device tree description, which can lead to kernel warnings and possible instability, but does not directly enable remote code execution. The likely attack vector is a kernel driver load in a system with improper DT configuration.