The MPRLS0025PA driver in the Industrial I/O subsystem was found to use a spi_transfer structure without fully zero‑initializing it before use. The CVE report states that the fix ensures the struct is zeroed out prior to use. It is inferred that uninitialized fields could result in unintended data being transmitted over the SPI bus, potentially leading to driver instability or kernel memory corruption, although the exact impact is not explicitly stated in the description.

All Linux kernel builds that include the MPRLS0025PA driver before the commit that applied this zero‑initialization fix are affected. The driver is part of the default kernel source, so any distribution shipping an unpatched kernel version is at risk. Both generic kernel images and custom configurations that enable this driver would be impacted.

The CVSS score is not publicly available and the EPSS data is not provided; KEV status is not listed. The likely attack vector requires local access to the SPI device and interaction with the driver, implying that an attacker would need local or privileged access. While no public exploit has been disclosed, the inferred potential for kernel memory corruption could allow a crash or privilege escalation if successfully triggered, resulting in a moderate to potentially high risk in environments where such local access is feasible.