A NULL pointer dereference occurs within the Linux kernel when the function spi_get_device_id() returns NULL and the code in spi_get_device_match_data() attempts to use this value. This scenario arises when the system employs driver_override without a corresponding matching SPI ID entry, allowing control of the device identification logic. The result is a kernel crash that can be triggered by supplying an invalid or malformed SPI configuration, leading to an interruption of system services.

The vulnerability affects all instances of the Linux kernel, as indicated by the vendor name Linux:Linux. No specific kernel versions are listed in the advisory, so any current or older kernel that has not incorporated the patch at the addresses indicated may be susceptible.

Because the flaw results in a NULL pointer dereference, exploitation could lead to a kernel panic and a denial of service. The CVSS score is 5.5 and the EPSS score is < 1%; the vulnerability is not listed in the CISA KEV catalog, making precise severity assessment difficult. However, a local attacker able to manipulate driver_override or supply an improperly formatted SPI device could trigger the defect. Remote exploitation would likely require additional local privileges to influence SPI configuration.