The Linux kernel’s mtd:mchp23k256 driver determines flash chip capacity from either the OF match table or the SPI id table. When the device is detected via a non‑OF SPI modalias, the driver mistakenly falls back to a hard‑coded capacity value, even when the SPI id table specifies a different part. This causes the kernel to configure an incorrect flash geometry, which can result in read/write operations accessing memory outside the intended flash area, leading to data corruption or system instability.

The flaw exists in all Linux kernel builds that include the mchp23k256 MTD driver before the fix that replaces of_device_get_match_data() with spi_get_device_match_data(). Any device running a kernel version with this driver enabled is at risk; devices using this driver in embedded boards or IoT devices are the primary class of affected systems.

The vulnerability’s CVSS score of 7.8 indicates a high impact on data integrity and availability. The EPSS score is less than 1%, and it is not listed in KEV, suggesting a low to moderate risk of public exploitation at present. The likely attack vector is local or physical access to the SPI bus, with an attacker able to manipulate the modalias or id table to force an incorrect geometry. While the flaw does not provide an arbitrary code execution path, incorrect geometry can overwrite adjacent memory or corrupt firmware, potentially crashing the system.