CVE-2026-23475

A flaw was found in the Linux kernel's Serial Peripheral Interface (SPI) component. The system's per-CPU statistics for the SPI controller were not allocated until after the controller was registered. This created a window where a local user or process could access system files (sysfs attributes) related to the SPI controller, leading to a NULL-pointer dereference. This vulnerability can cause a system crash, resulting in a Denial of Service (DoS).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.