A race condition in the Linux tegra210-quad SPI driver allows the shared transfer pointer to become NULL while an interrupt handler still assumes it is valid, resulting in a NULL pointer dereference and a possible kernel panic. The flaw originates from unsynchronized access of the curr_xfer field during ISR processing and timeout handling, and the description clarifies that the patch adds locking and an additional NULL check to prevent this unsafe access. The vulnerability is a concurrency bug that leads to integrity and availability loss at the kernel level, but does not provide an attack vector for code execution or data exfiltration.

Linux kernel versions 6.19 release candidates (rc1 through rc8) are affected. The issue exists in the tegra210-quad SPI driver and any system running those kernel versions on Tegra hardware. No specific vendor name is given beyond the Linux kernel.

The CVSS score of 4.7 indicates a moderate severity, and the EPSS score of less than 1% reflects a very low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog, suggesting no known public exploits. The likely attack vector is local and requires the attacker to trigger the race condition by initiating SPI transfers and causing a timeout on a Tegra platform. The impact is limited to a kernel crash, which would bring the operating system down. The overall risk remains moderate due to the low exploitation likelihood and the need for local, privileged access to exploit the race.