In the Linux kernel, the failure to call controller cleanup on spi_setup failure results in leaking resources allocated during device setup. The resulting resource exhaustion can degrade kernel stability and lead to a denial of service. This weakness falls under resource management errors.

All systems running the Linux kernel are potentially impacted, as the vulnerability is not limited to a specific version or distribution. Vendors identified are Linux, Linux, and the affected product is the Linux kernel itself. No version constraints are provided.

The vulnerability requires an attacker to trigger an spi_setup failure for a device in the kernel, which typically demands local user privileges or a compromised kernel process. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Consequently, while the possibility of exploitation exists, it is limited to scenarios where an attacker can invoke the problematic device setup path. The overall risk is moderate, emphasizing the importance of keeping the kernel updated.