The Linux kernel SPI driver does not allocate per‑CPU statistics until after a controller is registered. This creates a window in which reading driver sysfs entries can dereference a null pointer, causing an oops and a kernel crash. The weakness is a null pointer dereference (CWE‑476) and is fixed by allocating statistics at controller initialization.

Any Linux kernel version that contains the pre‑fix SPI driver implementation is affected. The vendor record lists “Linux:Linux,” and the CPE identifiers cover all linux_kernel builds, so the vulnerability applies to all architectures running an unpatched kernel. The specific affected versions are not listed explicitly; based on the description, it is inferred that versions prior to the merge of commit 118ce777d39f03cac99231196f820e4f998613a8 are vulnerable.

With a CVSS score of 5.5 and an EPSS score of less than 1 %, the risk is moderate. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local access to the sysfs interface, and a user can trigger a kernel panic by reading the driver attributes during the allocation window. There is no remote code execution risk, but a local attacker can cause a denial‑of‑service through a system crash.