During driver attachment in the Linux kernel, the SPI bus calls the match() callback without holding the device lock, allowing read of the driver_override field without proper synchronization. This race can result in a Use-After-Free condition that may corrupt memory or allow arbitrary execution of code with kernel privileges. The vulnerability arises from insufficient locking around the driver_override infrastructure; an attacker could potentially trigger it by manipulating the probing order or device removal during matchmaking, though the exact vector is not explicitly detailed in the advisory.

Linux kernel for all releases affected by the unpatched driver_override handling in the SPI subsystem. The issue is present until the kernel includes the commit that uses the generic driver_override infrastructure to enforce locking.

The exploitability of the vulnerability relies on inducing the race condition during driver probing. The EPSS score is less than 1% and the vulnerability is not listed in CISA KEV, indicating a low likelihood of exploitation in the wild. The CVSS score of 5.5 reflects a moderate severity, primarily due to its potential to cause data corruption or privilege escalation in kernel space. The lack of an explicit fix package in the advisory suggests that updating the kernel to the patched state is the definitive mitigation action.