A flaw in the Linux pinctrl driver for the MCP23S08 I/O expander causes the system to generate interrupts from a chip that may have the interrupt‑on‑change feature enabled after reboot. The driver reads the MCP_GPINTEN register, determining if pins are enabled for interrupts, but when an interrupt is pending for a pin that has no registered handler, the kernel processes a nested handler that does not exist. This results in an out‑of‑bounds read of unreadable memory and an oops crash. The immediate impact is a kernel panic that takes the system offline, exposing the affected host to denial of service. The weakness is a failure to validate that an interrupt source has an active handler before invoking it.

The issue exists in the Linux kernel’s pinctrl subsystem that supports MCP23S08 devices. All Linux kernel builds that include this driver are potentially affected, regardless of distribution or architecture. No specific product or version list is provided, but any kernel version compiled with the MCP23S08 pinctrl driver before the fix includes this vulnerability.

Because a device revision can trigger a kernel crash even in the absence of an attacker, the vulnerability is exploitable by anyone who can influence the device’s state (e.g., by resetting the chip to enable pending interrupts). The likelihood of exploitation is moderate: it requires the target to contain an MCP23S08 and for the chip to enter a state with enabled interrupts and no handler defined. EPSS data is not available, and this vulnerability is not listed in the CISA KEV catalog. The vulnerability’s CVSS score is not disclosed, but the nature of the crash suggests a high severity. Immediate patching is advised to prevent availability loss.