The spi-fsl-lpspi driver contains a teardown order bug that causes a use‑after‑free of the DMA channel structures while a SPI transfer is in progress. This results in a NULL pointer dereference in fsl_lpspi_dma_transfer, triggering a kernel panic and potentially terminating critical services. The crash therefore produces a local denial of service.

Based on the CPE entries, the affected kernels include Linux 4.10 and the 7.0 release candidates rc1 through rc7. The vendor/product details—Freescale/NXP LPSPI driver—are inferred from the driver name and are not explicitly specified in the input. Any Linux system that loads the spi‑fsl‑lpspi module or provides access to /dev/spidev* (e.g., embedded devices, routers, virtual machines) is potentially within scope.

The CVSS score of 7.8 and an EPSS < 1% indicate high severity but a very low likelihood of exploitation. Based on the description, the likely attack vector is a local attacker with access to /dev/spidev who initiates a transfer during driver removal, which generally requires privileged access to the device node. No mechanism for remote code execution or privilege escalation is provided. The flaw is not listed in CISA KEV and no public exploits are known, further reducing operational risk.