The vulnerability is a null pointer dereference in the MCP23S08 pinctrl driver caused by initializing mcp->dev and mcp->addr after regmap_init during probe to perform an SPI read with uninitialized pointers, leading to a kernel panic that can bring the entire system down. The flaw is identified as CWE-476 and results in a catastrophic availability loss for the affected node.

The bug exists in any Linux kernel that includes the unpatched MCP23S08 pincontrol driver before the commit moving the initialization. Because the vendor is Linux and the product is the Linux kernel, all distributions shipping a kernel prior to that change are potentially impacted. Deployments that load this driver during hardware startup are particularly susceptible.

The EPSS score is reported as < 1%, indicating a very low likelihood of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. The exploitation path requires the driver to be probed, which in turn requires a device or a privileged execution that can load the driver. Therefore the attack vector is inferred to be local or Privileged, meaning that an attacker would need access to the hardware or elevated privileges to trigger the crash. Applying the patch eliminates the patch is not immediately available, disabling the module mitigates exploitation.