Technical impact
The vulnerability lies in the wpcm_fiu_probe() function of the Linux kernel’s SPI subsystem, where the code may dereference a NULL pointer returned by platform_get_resource_byname(). This null dereference leads to a kernel crash and consequently a system reboot or unresponsive state, resulting in a denial of service. The weakness is a classic pointer dereference without null check (CWE‑476).
Affected Systems
Linux kernel distributions that include the WPCM‑FIU SPI driver are affected. No specific kernel version information is provided, so any kernel containing the unpatched wpcm_fiu_probe() code is potentially vulnerable.
Risk and Exploitability
The CVSS score of 5.5 indicates medium severity. The EPSS score is <1% and the issue is not listed in the CISA KEV catalog, indicating that it is not a known widely exploited vulnerability at this time. Based on the description, it is inferred that an attacker who has local or privileged access could load or configure the WPCM‑FIU driver (for example during boot or by executing modprobe) to trigger the crash. The likely attack vector therefore involves local kernel module manipulation. The lack of a public exploit and the requirement for kernel module control suggest a moderate risk, but the severity of a kernel crash warrants taking action even if exploitation probability is low.
Ubuntu USN