The vulnerability resides in the microchip-core-qspi driver of the Linux kernel, where the built‑in chip select is automatically driven by hardware rather than being controlled directly by software. When two SPI devices are attached, the automatic chip select remains active while the driver attempts to communicate with a device whose chip select is controlled by GPIO, so the wrong device is addressed. This results in either corrupted data being sent to the unintended device or failure to access the intended device, which can degrade system availability and data integrity.

All Linux kernels employing the microchip‑core‑qspi driver, notably those that connect multiple SPI devices to the same controller. Devices that rely on the built‑in chip select for active‑high operation or need the chip select disabled during transfer are most susceptible.

No CVSS score is provided and the EPSS is not available, and the vulnerability is not listed in CISA KEV. Due to the lack of a publicly known exploit path, the exploitation likelihood is uncertain. However, the flaw allows an attacker with the ability to access the SPI bus or influence the driver to trigger incorrect device selection, potentially leading to data corruption, denial of service, or unintended operation of peripheral devices. The inferred attack vector is local and requires access to the device tree or system configuration that controls SPI devices. The flaw remains critical for systems that depend on accurate chip‑select handling for bus reliability.