The vulnerability originates in the Linux kernel’s SPI subsystem, where the controller is deregistered after underlying resources such as DMA have already been released during driver unbind. This incorrect cleanup order can lead to the kernel accessing memory that has been freed or reallocated, resulting in a potential kernel panic or data corruption. The weakness is an improper resource release that allows an attacker to destabilize the system.

All Linux kernel builds that contain the affected SPI driver code without the applied fix. The specific branch or version is not listed, but the issue applies across all kernels that have not incorporated the commit referenced in the advisory.

The EPSS score of <1% indicates a very low exploitation probability, and the vulnerability is not listed in CISA KEV. The CVSS score is 5.5, indicating moderate severity. Based on the description, the likely attack vector involves a local actor capable of triggering driver unbind—for example, an application running with elevated privileges or a malicious user that can unload a module. If exploited, the flaw can cause the kernel to crash, leading to denial of service.