The vulnerability is a use‑after‑free condition in the Linux kernel’s SPI controller registration path. When per‑CPU statistics allocation fails, the kernel does not deregister the driver correctly, leaving freed driver resources that can still be accessed. Failure to clean up in this unlikely scenario can lead to an attacker executing arbitrary code inside the kernel or causing a crash. The weakness is formally classified as CWE‑825.

All Linux kernel implementations that include the affected SPI registration code are vulnerable. The flaw exists in the mainline kernel source that was current when the fix was made. No specific downstream distribution or kernel release list is supplied, so any system running an unpatched kernel before the commit that introduced the removal of this bug is at risk.

The CVSS rating of 7.8 indicates a high severity, and the EPSS value of less than 1 % suggests that exploitation is unlikely in the wild. The defect is not listed in CISA’s KEV catalog. A successful exploitation would require local kernel access or the ability to trigger the controller registration failure, which is an inferred local attack vector; remote exploitation is not documented.