The vulnerability resides in the SPI controller driver for Freescale devices in the Linux kernel. During driver unbinding, the controller was freed before proper deregistration, causing resources such as DMA descriptors to be released while the controller still referenced them. This flaw can lead to memory corruption and system crashes. The issue was resolved by ensuring the controller is deregistered prior to releasing underlying resources.

Linux kernel builds containing the affected SPI fsl driver prior to the patch. Any installation of a kernel version before the commit that introduces the fix may be vulnerable, regardless of specific distribution.

The EPSS score indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The flaw has a CVSS score of 5.5, indicating a medium impact. Based on the description, it is inferred that an attacker would need the ability to trigger the unbinding of the device, possibly via a local or remote interface that can unbind devices or through a vulnerable privileged service. Thus the potential impact remains significant, but the likelihood of exploitation is low.