The Linux kernel bug is triggered when the ACPI idle driver registration path is executed without an active cpuidle driver. The missing guard causes a NULL pointer dereference in __cpuidle_register_device(), which can result in a kernel panic. The crash forces a system reboot, interrupting all services. The vulnerability does not grant an attacker code execution or direct data compromise.

The vulnerability affects the Linux kernel. No particular release version is listed in the advisory, so administrators should confirm whether their kernel includes the commit 7a8c994cbb2d that addresses the issue.

The CVSS score of 5.5 indicates moderate severity and a single out-of-bound condition that can lead to a crash. The EPSS score is less than 1%, implying a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is not explicitly documented; based on the description, it is inferred that an attacker would need local access to manipulate ACPI events to trigger the fault, making remote exploitation unlikely. The primary consequence of exploitation is an availability loss due to system reboot, with no direct impact on confidentiality or integrity.