The vulnerability arises when the SPI mpc52xx controller fails to register; interrupts are disabled but not freed, leading to a use-after-free and a resource leak that could corrupt kernel memory or crash the system. Based on the nature of the use-after-free, it is inferred that an attacker able to trigger device registration could potentially read or write arbitrary kernel memory, raising the risk of privilege escalation or denial of service.

Linux kernel implementations that include the mpc52xx SPI controller driver are affected until the fix is applied. No specific kernel versions are listed in the CNA data, so any system using a version that has not been patched may be vulnerable.

The EPSS score is below 1% and the CVSS score is 7.8. The flaw is not listed in the CISA KEV catalog. Based on the description, exploitation appears to require local access that can trigger device registration could potentially read or write arbitrary kernel memory, raising the risk of privilege escalation or denial of service.