The SP RD SPI driver in Linux attempts to release DMA channels or dereference an error pointer after a DMA setup failure during probe. The driver does not verify the dma.enabled flag before doing so. This flaw can trigger a kernel crash and results in a denial of service. The weakness corresponds to CWE‑476.

All Linux kernel releases that include the SP RD driver are impacted, including the generic Linux kernel and the 7.1 release candidates (rc1–rc4). Any distribution kernel that ships the default SP RD driver and loads it during boot or at hotplug time can be affected.

The CVSS score of 5.5 indicates a medium severity. The EPSS score is below 1%, and the vulnerability is not listed in the CISA KEV catalog, which together suggest a low probability of exploitation in the wild. Exploitation would require an attacker who can influence the probe of a SPI device—for example, having privileged or physical access to the device—to force a DMA setup failure. Such conditions are unlikely for remote attackers, but the crash impact is deterministic once triggered.