The spidev driver in the Linux kernel used two mutexes, spi_lock and buf_lock, that were acquired in inconsistent orders depending on the operation path; write or read operations locked buf_lock first and then spi_lock, while ioctl paths took spi_lock before buf_lock. This AB‑BA ordering can trigger lockdep warnings and result in a real deadlock, halting SPI operations and potentially freezing processes that rely on the device. The issue is observable with a simple userspace program that performs concurrent write() and an SPI_IOC_WR_MAX_SPEED_HZ ioctl on the same file descriptor from separate threads.

All Linux kernel installations that include the spidev driver and have not applied the fix are affected. No specific kernel version range is given in the advisory, so any kernel in use is potentially vulnerable until it is upgraded to the patched release. The spidev interface remains part of the official Linux kernel source tree for all distributions.

The vulnerability requires the ability to open the /dev/spidev* device node, which normally requires root privileges or belonging to the appropriate group. Based on the description, it is inferred that the attacker would need these permissions to trigger the deadlock. An attacker could cause a denial of service by performing concurrent I/O operations from multiple threads on the same device descriptor, halting SPI peripheral access. The CVSS score of 5.5 indicates moderate severity, and the weakness maps to CWE‑413 (Inverted Locking Pattern) and CWE‑667. The EPSS score of < 1% indicates an extremely low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The patch eliminates the second mutex and serializes access with spi_lock, removing the lock inversion problem entirely; once the kernel is updated, the risk is mitigated.