The vulnerability is a null‑pointer dereference in the Linux kernel’s SPI driver for Spreadtrum devices (SP RD). During device probe, if a DMA setup fails, the driver attempts to release DMA channels or dereference an error pointer without checking the dma.enabled flag. This flaw can corrupt kernel memory and cause a kernel panic, leading to a denial of service.

All Linux kernel versions that include the affected SP RD driver without the patch are vulnerable. This includes every distribution kernel that ships the default SP RD driver, since the driver is part of the core Linux kernel. No separate vendor product line is listed beyond Linux:Linux. The vulnerability exists on any system that uses the driver for SP RD devices and can load it during boot or hotplug.

The EPSS score is reported to be under 1%, and the issue is not listed in the CISA KEV catalog, indicating a low probability of exploitation in the wild. However, the impact of a kernel crash is catastrophic for any host that relies on the affected driver. Based on the description, it is inferred that the exploit requires control over the device configuration that triggers the probe or a capability to force a DMA setup failure, which is typically limited to privileged users or physical attackers with access to the SPI device.