In the Linux kernel, the ti‑qspi driver contains a use‑after‑free condition that arises when DMA setup or buffer allocation fails during the probe routine. The driver fails to clear its DMA channel pointer in those failure paths, allowing the DMA engine to operate on a dangling reference or leading to a double free of the channel. This kernel memory corruption can be leveraged to execute arbitrary code with kernel privileges. The flaw is not exposed through normal user‑space interfaces; an attacker would need to influence the probe sequence or induce the faulty condition to trigger the bug.

All Linux kernel builds that ship with the ti‑qspi driver are affected. The issue existed before commit 178b9b57 and was fixed in that commit. Any distribution or custom kernel that has not incorporated this change remains vulnerable, regardless of kernel version or release candidate. The problem does not depend on specific kernel configuration options beyond the presence of the driver.

The CVSS score of 7.8 indicates high severity, while the EPSS score of less than 1 % reflects a low but nonzero probability of exploitation. The vulnerability is not present in the CISA KEV catalog. An attacker would need to trigger a DMA setup or buffer allocation failure during probe, which typically requires local access to the TI QSPI peripheral or the ability to manipulate its state. Without such local or device‑level control, the risk is moderate to low. The attack vector is inferred to be local; no direct remote exploitation path is documented.