A kernel driver for SPI devices on the ep93xx family has an error‑pointer dereference that can occur when a DMA setup fails during the probe phase. The fault is triggered because the driver fails to clear DMA channel pointers after a failure, allowing later code to attempt to use an invalid pointer, which results in a kernel panic and system crash. The weakness is identified as CWE‑476 (null pointer dereference) and CWE‑824 (uninitialized or invalid value). The impact is a local denial of service: a user with privilege to load the driver or reload the kernel module can force a kernel crash, causing loss of availability and potential loss of data if the system is not recovered.

Any system running a Linux kernel that includes the ep93xx SPI driver is affected. No specific kernel version range is listed, but any kernel containing the unpatched ep93xx driver is vulnerable. The specific vendor is Linux, and the affected components are broadly the Linux kernel’s SPI ep93xx driver implementation.

The EPSS score is < 1%, indicating a very low probability of automated exploitation. The vulnerability is not cataloged in the CISA KEV database, further suggesting limited active exploitation. The CVSS score of 5.5 indicates a medium severity. Because the fault occurs during driver probe and requires the driver to be loaded, the attack vector is local with an attacker needing some level of user or kernel module loading privileges. Successful exploitation would lead to a system crash, allowing a local attacker to disrupt service or cause further damage after a reboot. Because it is a local denial of service, the threat is moderate, but for systems where uptime is critical, the risk should be addressed promptly.