The vulnerability is a double free in the Linux kernel’s SPI driver for SPRD ADI devices. When probe registration fails, the driver releases the controller both manually and through the device core, corrupting the kernel’s memory management of the SPI controller. This leads to a double free identified as CWE‑415, which can cause kernel crashes and potentially allow local attackers to execute arbitrary code or gain elevated privileges within the kernel context.

The issue affects Linux kernel 6.19 release candidates from rc1 through rc6, as indicated by the vendor’s CPE listings. Systems running these kernel versions without the patch are susceptible.

With a CVSS score of 7.8, the vulnerability presents a medium‑high severity. The current EPSS score is below 1 %, suggesting a low probability of exploitation at present, and it is not listed in CISA’s KEV catalog. Nevertheless, the double‑free flaw can be invoked through the driver’s error path and may lead to kernel instability or privilege escalation for users with local access that can trigger the problematic probe sequence.