The CVE identifies that the Linux kernel’s spi/mpc52xx driver deregisters the controller after disabling and releasing resources such as interrupts and GPIOs during the driver unbind process. This ordering can leave dangling references to freed memory or improper cleanup of hardware resources, which may manifest as kernel instability or malfunctioning SPI operations.

Any Linux kernel that includes the spi/mpc52xx driver is affected. Specific kernel version ranges are not provided in the advisory, so the issue may exist in multiple releases prior to the applied fix.

The CVSS score of 5.5 indicates a moderate severity. The EPSS score of less than 1% suggests a very low but non‑zero likelihood of exploitation, and the vulnerability is not listed in CISA KEV. The CVE description does not specify an attack vector or privilege requirement; therefore, it is unknown whether an attacker could exploit this flaw without elevated privileges or how the flaw might be abused.