The vulnerability occurs when the SPI subsystem unbinds a device, freeing the controller and associated driver data before the driver has finished using it. This causes a use‑after‑free condition that can corrupt memory and provide a foothold for arbitrary code execution.

All Linux kernel installations that include the spi:imx driver are affected until the fix described in the referenced commits is applied. Specific kernel versions are not enumerated in the data, so any build predating the patch is considered vulnerable.

Use‑after‑free flaws are generally considered a high‑severity issue; the CVSS score is not provided, and EPSS is unavailable, but the absence of a KEV listing does not diminish the inherent risk. An attacker with local or kernel‑privileged access, or one able to trigger driver unbinding, could exploit the flaw to corrupt memory and potentially gain elevated privileges. The lack of a listed exploit in exploitation databases only indicates that a public exploit has not been reported yet, not that the vulnerability is less dangerous.