A null pointer dereference can occur in the SPI DMA driver when an error is generated and the device has no current message. The kernel attempts to log the error incorrectly, resulting in an unexpected crash that may bring the entire system down. This flaw is identified as CWE-476 and NVD-CWE-noinfo and would allow an attacker who can trigger such a driver error to cause a denial‑of‑service condition. The vulnerability is not tied to a remote payload; it requires local or privileged code to exercise the driver error path.

The flaw exists in the Linux kernel for version 5.8 and all release candidates of version 7.0 (rc1 through rc7) as well as any general kernel builds that include the spi-dw-dma driver without the patch. Administrators using these kernel versions should check whether the spi-dw-dma subsystem is active on the system.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% shows that the exploitation probability is low at present. Because the issue leads to a kernel crash, it is considered a local or privileged threat: an attacker must be able to provoke the driver error on the affected machine. The vulnerability is not listed in the CISA KEV catalog, suggesting that no widespread, actively exploited variants are known.