The Linux kernel flaw occurs when dmaengine_prep_slave_sg() fails for a transmit (TX) channel in the fsl‑lpspi SPI driver. The error path terminates the TX DMA channel but leaves the receive (RX) channel running. Because the RX channel was already started before the TX descriptor was prepared, the kernel unmapped the DMA buffers while the RX DMA engine continued writing to them, leading to potential memory corruption or a use‑after‑free condition that can crash the kernel or allow an attacker to inject malicious code.

The vulnerability affects all Linux kernel builds that include the fsl‑lpspi SPI driver and have not yet incorporated the patch that cleans up the RX channel on TX failure. No specific kernel release range is listed, so any distribution version that ships with the unpatched driver is at risk.

The CVSS score of 9.8 indicates a critical severity, and the EPSS score of less than 1 % shows a very low probability of exploitation so far. The flaw is not yet in CISA’s KEV catalog. The attack requires local access to an SPI device that uses the fsl‑lpspi driver; based on the description, the likely attack vector is inferred to involve an attacker who can issue SPI transactions to the device and trigger a DMA preparation failure to corrupt kernel memory. No known exploits are publicly documented at this time.