The microchip‑core‑qspi driver in the Linux kernel mistakenly initiates data transmission while performing read‑only dual/quad operations. Because QSPI lacks a dedicated master‑out line, this erroneous transmission corrupts the clock sequence and can completely halt the transaction, effectively bricking the peripheral bus. The flaw does not expose data or grant additional privileges; its impact is limited to availability of the QSPI interface.

Any Linux kernel build that contains the unmodified microchip‑core‑qspi driver is affected. The vulnerability is confined to the QSPI subsystem, so only QSPI devices and drivers that rely on the core‑qspi module are at risk. Distribution‑specific kernel versions that shipped unpatched are vulnerable, but no specific vendor or product versions are listed in this advisory.

Exploitation of the flaw appears to require local kernel execution or privileged access to trigger the faulty transaction. The EPSS score of less than 1% indicates a very low probability of real‑world exploitation, and the vulnerability is not catalogued in CISA’s KEV. Nonetheless, repeated bricking of QSPI transfers can severely disrupt systems that depend on these devices, making the defect a moderate availability risk within affected environments, as reflected by the CVSS score of 5.5.