The McP23s08 pincontrol driver performs a regmap initialization that triggers a cache population via an SPI read. If mcp->dev and mcp->addr are not initialized beforehand, the SPI read dereferences a NULL pointer, resulting in a kernel panic. This flaw is a classic null pointer dereference, classified as CWE‑476 and CWE‑908, and can bring the entire operating system offline when a vulnerable driver is probed.

Linux kernel versions prior to the commit that moves mcp->dev and mcp->addr initialization before regmap init are affected. Any distribution shipping such kernels will load the MCP23S08 pinctrl module when matching hardware is present, meaning deployments that use MCP23S08 I/O expanders during boot or runtime are potentially impacted. Older kernels on systems without the update, especially those with the module enabled, are at risk.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of <1% points to a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need local or privileged access to the MCP23S08 hardware or to load or unload the driver, because the fault occurs only during driver probe. Therefore, the primary threat is to system availability for locally or privileged attackers, with minimal risk of remote compromise.