A double decrement of the reference count for the meson‑spicc SPI controller occurs when the driver’s remove path calls spi_controller_put() twice. This mis‑management can lead to the controller being released while still in use, potentially triggering a use‑after‑free, kernel crash, or allowing an attacker to execute arbitrary code with kernel privileges.

The flaw resides in the Linux kernel’s meson‑spicc driver, affecting all kernel versions that include this driver before the patch. Version information is not specified in the advisory, but any release that contains the unfixed driver is vulnerable.

The CVSS score is 7.8, indicating a high severity. The EPSS score of 0.00023 (< 1%) indicates a very low but nonzero likelihood that the vulnerability will be actively exploited. The double reference count decrement is a classic use‑after‑free condition. While the vulnerability is not catalogued in CISA’s KEV, the potential impact is still high. An attacker would need to trigger the driver’s remove routine, which typically requires privileged or local access. In environments where an attacker can unload kernel modules or control device removal, the risk escalates to potential kernel compromise.