The mmc_spi_data_do function updates a counter of bytes transferred after each block. If during a multi‑block transfer a later block fails with a CRC error, the counter contains the number of bytes transferred before that failure. The recovery path in mmc_spi_request re‑issues the command without resetting this counter. If the retry succeeds, the reported byte count may include data from the failed attempt, leading the system to believe more bytes were transferred than actually were. This misattribution can inflate reported transfer sizes, potentially exceeding the original request size. The flaw does not corrupt the data itself but produces inaccurate accounting of transferred bytes.

Linux kernels that include the mmc_spi driver and are used with MMC‑over‑SPI storage devices are potentially vulnerable. No specific kernel version range is provided, so any build of the Linux kernel that contains the unpatched mmc_spi code may be affected. The advisory lists only Linux as the vendor.

The CVSS score of 5.5 indicates moderate severity. The EPSS score of <1% suggests a very low probability of exploitation. Because the flaw is only triggered by a CRC error followed by a successful retry, it requires a fault on the SPI bus that is unlikely to be intentionally induced by a remote attacker. The vulnerability is not listed in the CISA KEV catalog, indicating no known active exploits. Overall, the risk to a system is low, but the misreported byte counts can cause downstream inconsistencies in applications that rely on accurate transfer metrics.