The vulnerability lies in the microchip-core-qspi driver of the Linux kernel. The hardware automatically drives the built‑in chip select low when a transfer begins and high when all bytes are sent. When two devices are attached—one using the built‑in chip select and the other controlled by a GPIO—the driver may keep the built‑in chip select active while accessing the GPIO device, causing the wrong device to be addressed. This leads to data corruption, incorrect configuration, or a denial of service for the intended device. The flaw represents a control flow error that could be exploited by components that run after boot and can influence peripheral configuration; it is classified as CWE‑372, a misuse of conditional logic that results in improper chip‑select control.

All Linux kernels that load the microchip-core-qspi driver and connect multiple SPI devices to the same controller are impacted. Systems that rely on the built‑in chip select for active‑low operation or use GPIOs for other devices are especially susceptible. Boards that previously avoided the built‑in chip select may still be at risk if the driver is updated or new SPI devices are introduced.

The EPSS score is below 1%, indicating a very low but non-zero exploitation probability. The CVSS score of 5.5 denotes a medium severity that can lead to data integrity or availability issues on the SPI bus. The vulnerability is not listed in the CISA KEV catalog and no public exploit is known. The likely attack vector is local: an adversary would need the ability to modify the device tree or alter the driver’s configuration. Because the issue affects only the sequencing of chip‑select signals, the impact is limited to data integrity or availability on the SPI bus rather than full system compromise.