The McP23s08 pincontrol driver performs a regmap initialization that triggers a cache population via an SPI read. If mcp->dev and mcp->addr are not initialized beforehand, the SPI read dereferences a NULL pointer, resulting in a kernel panic. This flaw is a classic null pointer dereference, classified as CWE‑476, and can bring the entire operating system offline when a vulnerable driver is probed.

Linux kernel versions prior to the commit that moves mcp->dev and mcp->addr initialization before regmap init are affected. Any distribution shipping such kernels will load the MCP23S08 pinctrl module when matching hardware is present, meaning deployments that use MCP23S08 I/O expanders during boot or runtime are potentially impacted. Older kernels on systems without the update, especially those with the module enabled, are at risk.

The EPSS score is <1%, indicating a very low probability of exploitation. The vulnerability is not in the CISA KEV catalog. An attacker would need local or privileged access to the hardware that drives the MCP23S08 or to load/unload the driver, as the fault is triggered only during driver probe. The primary threat is to availability for local or privileged attackers, with minimal risk of remote compromise.