The vulnerability lies in the amlogic-spisg SPI driver where the clk_init_data structure is not fully initialized before use. The code assumes certain members are NULL while they remain uninitialized, leading to a crash when the driver accesses the stale pointers. This crash results in a kernel panic and a system reboot, compromising availability.

Linux kernel binaries that include the amlogic-spisg driver, such as those compiled in many ARM-based distribution kernels. Versions of the kernel that contain the buggy data structure handling are affected; no specific kernel version numbers are listed in the available information.

The exploitation requires the vulnerable driver to be loaded; an attacker can trigger a crash by interacting with the SPI interface or by inducing a context that causes the driver to access the uninitialized structure. EPSS data are not reported, and the vulnerability is not listed in the CISA KEV catalog, but a kernel panic is a severe outcome. The CVSS score is not provided, but given the impact on system availability, the risk is considered high pending patch classification.