A flaw in the Linux pinctrl driver for the MCP23S08 I//O expander causes the system to generate interrupts from a chip that may have the interrupt‑on‑change feature enabled after reboot. The driver reads the MCP_GPINTEN register, determining if pins are enabled for interrupts, but when an interrupt is pending for a pin that has no registered handler, the kernel processes a nested handler that does not exist. This results in an out‑of‑bounds read of unreadable memory and an oops crash. The immediate impact is a kernel panic that takes the system offline, exposing the affected host to denial of service. The weakness is a failure to validate that an interrupt source has an active handler before invoking it.

The issue exists in the Linux kernel’s pinctrl subsystem that supports MCP23S08 devices. All Linux kernel builds that include this driver are potentially affected, regardless of distribution or architecture. No specific product or version list is provided, but any kernel version compiled with the MCP23S08 pinctrl driver before the fix includes this vulnerability.

Because a device revision can trigger a kernel crash even in the absence of an attacker, the vulnerability is exploitable by anyone who can influence the device’s state (for example, by resetting the chip to enable pending interrupts). The likelihood of exploitation is low, with an EPSS score of less than 1%, yet the impact remains severe if achieved. The vulnerability is not listed in the CISA KEV catalog. The CVSS score is not disclosed, but the crash indicates high severity. Immediate patching is advised to prevent availability loss.