The spi-fsl-lpspi driver in the Linux kernel contains a teardown order bug that causes a use‑after‑free of the DMA channel structures while a SPI transfer is in progress. When the driver’s remove function tears down the DMA channels synchronously, the controller register remains freed, and a continued SPI transfer dereferences a null pointer. The resulting NULL pointer dereference triggers a kernel panic, leading to a system crash. This flaw could enable a local attacker that can drive the SPI controller to cause loss of availability or, if the crash can be fully controlled, potentially to elevate privileges or execute code in kernel space.

All Linux kernel distributions that include the Freescale/NXP LPSPI (low‑power serial peripheral interface) SPI driver are affected. The vulnerability is present wherever the spi-fsl-lpspi module is loaded, regardless of kernel release, because no specific version is listed. Users of embedded devices, routers, or virtualization guests that rely on this driver are subject to the risk.

The CVSS score is not supplied, and the EPSS score is unavailable, so the precise quantitative risk is unknown. However, the flaw is an unchecked use‑after‑free that can be triggered by performing a SPI transfer while the driver is being removed, which is an action a local user with access to the device node or a privileged process can conceivably perform. The lack of a public KEV listing suggests that known exploits are not yet documented. In the absence of a high EPSS score, the primary threat is a potential local denial of service with a risk of privilege escalation if the kernel crash can be manipulated for code execution. The attack vector is inferred to be local, requiring the ability to initiate or control SPI transfers during driver unregistration.