The vulnerability involves the Linux kernel's SPI controller driver for Freescale devices. During driver unbinding, the controller was released without proper deregistration first, causing underlying resources such as DMA to be freed while the controller still referenced them. This improper cleanup can lead to memory corruption, system crashes, or even privilege escalation if exploited.

All Linux kernel builds that include the affected SPI fsl driver before the patch. No specific operating system releases were listed; any installation of a Linux kernel from the time before the commit that contains the faulty driver is potentially affected.

The CVSS score and EPSS data are not available, and the vulnerability is not listed in the CISA KEV catalog. However, the nature of the flaw—kernel memory corruption during driver unbind—indicates a high risk if an attacker can trigger driver removal. The likely attack vector is through local or remote code execution that forces the device to be unbound, which could be leveraged by privileged services or, in theory, a remote attacker if such a service is exposed. The risk remains high due to the kernel's privileged context and the potential for arbitrary code execution or system instability.