A flaw in the Linux kernel's ACPI processor handling allows device pointers to be dereferenced after the kernel has released the reference to the underlying device object. This creates a use‑after‑free condition that can corrupt kernel memory, potentially allowing an attacker with sufficient privileges to execute arbitrary code or cause a system crash.

All Linux kernel implementations that contain the ACPI processor errata logic before the patch was applied are affected. This includes common distribution kernel packages—such as Ubuntu, Debian, Red‑Hat, CentOS, Fedora, and others—up to the point where the kernel has incorporated the upstream fix for acpi_processor_errata_piix4. The exact kernel versions are not enumerated, so any kernel in use prior to including the commit is potentially vulnerable.

The vulnerability is a classic use‑after‑free (CWE‑416). No CVSS or EPSS data are provided, and the issue is not listed in the CISA KEV catalog. Exploitation would require local access or an attacker that can trigger kernel code paths that perform the faulty dereference. Though no publicly available exploits are documented, a successful exploitation could lead to privilege escalation or denial of service at the kernel level.