The Linux kernel bug is triggered when the ACPI idle driver registration logic is executed without an active cpuidle driver. The missing check causes the system to dereference a null pointer in __cpuidle_register_device(), potentially leading to a kernel panic and service interruption. The vulnerability does not directly grant code execution, but a crash requires a reboot to restore service, resulting in downtime.

The affected product is the Linux Operating System’s kernel, but no specific kernel releases are listed in the advisory. Organizations should verify if their current kernel build contains the commit that fixed this bug.

An exploit would likely require local access to manipulate ACPI events to trigger the faulty path. Because the attack vector is not clearly documented, the risk of remote exploitation is low. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, but the absence of a mitigation path in widely used kernels warrants cautious response. The kernel crash would end the affected process, so the main risk is availability loss rather than confidentiality or integrity.