In the Linux kernel, the SPI subsystem contains a flaw where controller statistics are allocated only after the controller has been registered with driver core. Until that point, accessing sysfs attributes for the controller can dereference a NULL pointer, which triggers a kernel panic. This results in a denial of service by crashing the kernel.

The flaw affects all Linux kernel versions that include the pre‑commit SPI driver code. Any system running a kernel build that has not incorporated the change that allocates statistics during controller construction is vulnerable. The affected product is the Linux kernel, specifically the SPI core.

The CVSS score is not provided, and the EPSS score is unavailable, indicating no publicly available data on exploitation potential. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector requires local access to the SPI sysfs attributes; an attacker would need to read or write these attributes before the controller is fully registered. Successful exploitation leads to a kernel panic and system reboot, but no public exploits are currently documented.