The flaw lies in the Amlogic spifc‑a4 SPI flash controller driver in the Linux kernel. Three separate bugs were identified in the DMA buffer setup routine: an unnecessary jump that pretends to perform cleanup when the first DMA mapping fails, a double‑unmap that can corrupt kernel memory, and an incorrect unmap size that can cause improper synchronization. It is inferred that if the DMA mapping fails, the double‑unmap and incorrect unmap size can lead to a kernel panic or memory corruption, thereby causing a denial‑of‑service scenario when an attacker induces such a failure.

All Linux kernel releases that contain the unpatched spifc‑a4 driver are affected; this includes embedded devices, single‑board computers, and other systems powered by Amlogic SoCs that use the driver. The precise kernel versions are those before the patch commits referenced in the advisory. Devices runing those kernel builds are at risk until the update is applied.

No CVSS score is disclosed and the EPSS score is less than 1%, indicating a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The risk is local and manifests when a DMA mapping error occurs; an attacker would need to trigger that failure, which may require local or privileged access to the device. The potential impact is severe kernel memory corruption or a crash, resulting in a denial of service for the affected host.