A use‑after‑free condition was identified in the Linux kernel’s SPI controller registration path. When per‑CPU statistics allocation fails during controller setup, the driver core deregistration was omitted, leaving driver resources dangling. If these resources are later accessed, the kernel may perform unclocked register operations on freed memory, resulting in memory corruption that can be leveraged to gain higher privileges or crash the system.

All Linux kernel releases that contain the affected SPI controller code are impacted. The CNA lists the generic vendor product ‘Linux:Linux’ twice and no specific version range is provided, implying that the flaw exists across the default kernel branches at the time of the fix. Users should check the release notes for the kernel version they run to confirm whether the patch has been applied.

Use‑after‑free vulnerabilities in kernel code are traditionally high‑impact. Although the EPSS score is not available and the issue is not listed in CISA’s KEV catalog, the nature of the flaw (freeing driver resources before completing registration) makes it exploitable by a local attacker with capabilities to load or manipulate SPI drivers. Successful exploitation could lead to arbitrary code execution with kernel privileges or a denial‑of‑service attack that destabilizes the system.