A flaw in the Linux pinctrl driver for the MCP23S08 I\/O expander causes the system to generate interrupts from a chip that may have the interrupt‑on‑change feature enabled after reboot. The driver reads the MCP_GPINTEN register to determine which pins are enabled for interrupts, but when an interrupt is pending for a pin that has no registered handler, the kernel attempts to invoke a nested handler that does not exist. This results in an out‑of‑bounds read of unreadable memory and an oops crash, taking the system offline and emphasizing a denial of service impact.

The issue exists in all Linux kernel builds that include the MCP23S08 pinctrl driver. Any kernel compiled with this driver before the fix includes the vulnerability, regardless of distribution, architecture, or version. Specific vulnerable kernel versions are not listed, so all kernels with the driver should be considered potentially affected.

Because a device revision can trigger a kernel crash even without an external attacker, the vulnerability can be exploited by anyone who can influence device’s state, such as by resetting the chip to enable pending interrupts. The EPSS score is less than 1%, indicating a low probability of exploitation, yet the impact remains severe if achieved. The CVSS score of 5.5 denotes moderate severity. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is inferred to be physical or firmware manipulation of the MCP23S08 device that sets interrupt‑on‑change bits before the kernel probes the device.