The vulnerability originates in the Linux kernel’s SPI subsystem, where the controller is deregistered after underlying resources such as DMA have already been released during driver unbind. This incorrect cleanup order can lead to the kernel accessing memory that has been freed or reallocated, resulting in a potential kernel panic or data corruption. The weakness is an improper resource release that allows an attacker to destabilize the system.

All Linux kernel builds that contain the affected SPI driver code without the applied fix. The specific branch or version is not listed, but the issue applies across all kernels that have not incorporated the commit referenced in the advisory.

The supply data does not provide a CVSS score or an EPSS metric, and the vulnerability is not listed in the CISA KEV catalog, so the exact severity and exploitation likelihood cannot be quantified. However, based on the description, the likely attack vector involves a local actor with the ability to trigger driver unbind—for example, an application running with elevated privileges or a malicious user that can unload a module. If exploited, the flaw can cause the kernel to crash, leading to denial of service and potential subsequent privilege escalation. This risk assessment is based solely on the available information and the inferred attack path.