A flaw in the Linux kernel ACPI GHES handler permits a malformed or truncated ARM Processor Error record, emitted by the BIOS, to cause the kernel to dereference memory past the bounds of the supplied data structure. This results in a kernel OOPS that brings the system down or forces a reboot, providing an attacker with a means to deny service. The bug is a direct memory access error that can lead to a crash rather than code execution. The likely attack vector requires control of the firmware or ability to inject a forged GHES event, so it is considered a low‑to‑medium effort local or firmware‑based attack.

The issue resides in the Linux kernel source tree; the resolving patch was introduced in a specific commit to the mainline repository. All Linux kernel distributions that contain the unpatched code are vulnerable, including mainstream, embedded, and custom builds. No specific kernel version range is given, so every build before the patch should be considered affected.

No CVSS score is provided in the advisory, EPSS data is missing, and the vulnerability is not listed in CISA’s KEV catalog. The weakness causes a hard kernel crash, which is a high‑impact availability risk. Exploitation would require a crafted GHESv2 record from firmware or a malicious BIOS, which, while not trivial, can be achieved by firmware compromise or insider threat. Consequently, the likelihood of exploitation is low to moderate, but the impact of a successful exploit is severe.