The Linux kernel’s ACPI platform subsystem previously used acpi_get_first_physical_node() to retrieve a reference to a physical node device. That function may return a reference that can be freed asynchronously, creating a use‑after‑free condition that could corrupt kernel memory or crash the system. The fix replaces the unsafe call with acpi_bus_get_primary_device(), obtains the reference once, then releases it after use, eliminating the window for the vulnerability.

All Linux kernel releases containing the ACPI platform subsystem that have not included the upstream patch replacing acpi_get_first_physical_node() with acpi_bus_get_primary_device() are potentially affected. This includes mainline kernels and any derivative distributions that have not yet applied the change.

The CVSS score of 7.8 indicates high severity, while the EPSS score of fewer than 1% suggests a low probability of exploitation at disclosure time, and the issue is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need local or privileged access to supply malicious ACPI tables or otherwise influence the ACPI subsystem, triggering the use‑after‑free. Successful exploitation could lead to kernel memory corruption, loss of stability, or a system crash.