The ACPI platform subsystem in the Linux kernel used acpi_get_first_physical_node() to obtain a reference to a physical node device. That function may return a reference to a device that can be freed asynchronously, which could lead to a use‑after‑free condition. The fix replaces it with acpi_bus_get_primary_device() to obtain the device once and drop the reference after use. This change reduces the risk of kernel memory corruption that could cause a system crash.

All Linux kernel releases that include the ACPI platform subsystem and have not applied the upstream patch replacing acpi_get_first_physical_node() with acpi_bus_get_primary_device() are potentially affected. The vulnerability exists in the mainline kernel code path for acpi_platform_fill_resource() and acpi_create_platform_device().

The CVSS score of 5.5 indicates moderate severity. The EPSS score of less than 1% shows a low probability of exploitation at the time of the advisory, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the vulnerability may be triggered by malformed ACPI tables or a platform driver that calls into acpi_get_first_physical_node(). The likely attack vector involves the kernel ACPI subsystem and requires local or privileged access to supply malicious ACPI data. The impact would be kernel memory corruption and potential system destabilization.