The spacemit pin controller driver for Linux harbors a NULL pointer dereference in the spacemit_pin_set_config function. It incorrectly checks the local pin identifier instead of the result of spacemit_get_pin(), which can cause the driver to skip pin 0 configuration or, if the lookup fails, dereference a NULL pointer. The fault can lead to a kernel panic or, more subtly, to essential PAD settings being ignored—resulting in poor electrical behavior of the SoC’s pins.

All Linux kernels that include the spacemit driver before the fixes introduced in commits 09c816e5c4d3a8d6d6e4b7537433e5e98505d934 and 7a551951ebeb5b3f05bdb04a73d4593869c984c4 are vulnerable. Systems with SoCs that use the spacemit pinctrl—such as various K3 boards—are affected if they run an unpatched kernel containing this driver.

The CVSS base score of 5.5 indicates moderate impact, and the EPSS score of less than 1% suggests a very low current probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. An attacker would need local access to trigger the fault, typically during device configuration or by processing a crafted packet that forces the driver to configure pin 0. Given the low EPSS, the likelihood of widespread exploitation is small, but the potential for a kernel panic or silent mis‑configuration warrants remediation.