In the Linux kernel, the spi_setup call fails to invoke controller cleanup when a device registration cannot be completed. The missing cleanup results in resources that were allocated during the partial setup remaining resident in kernel memory. The overflow of unreleased resources can, over time, exhaust kernel memory or other critical resources, potentially destabilizing the kernel and leading to a denial of service. The flaw corresponds to both the CWE‑401 Resource Leak weakness and the CWE‑772 Improper Resource Management weakness.

All Linux kernel‑based systems are affected because the vulnerability resides in the core kernel SPI subsystem. No specific kernel version is listed, so any system running a Linux kernel that does not include the spi cleanup fix may be vulnerable.

Based on the description, it is inferred that the exploit requires an attacker to trigger a spi_setup failure, which generally means influencing device registration within the kernel, typically achievable with local user privileges or by compromising a kernel process. The EPSS score of 0.00123 indicates a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 5.5 indicates a moderate severity, suggesting that repeated exploitation could deplete system resources and degrade availability. Based on the description, it is inferred that the overall risk remains moderate but can become significant for attackers with kernel‑level or local control.