A null-pointer dereference occurs in acpi_processor_errata_piix4() when a first device lookup succeeds and a second lookup fails, overwriting the device pointer with NULL and causing dev_dbg() to dereference a NULL pointer. This flaw can trigger a kernel crash, effectively denying service to the system. The weakness is a classic null-pointer dereference.

The vulnerability affects the Linux kernel, as indicated by the vendor and product names. No specific kernel versions are listed in the CNA data; however, any kernel implementing the defective acpi_processor_errata_piix4() code may be affected. Users running an unpatched kernel should verify whether the code path is enabled.

The CVSS score of 5.5 indicates moderate severity. The EPSS score of 0.00032 reflects a very low exploitation probability and the vulnerability is not listed in CISA KEV. Based on the description, it is inferred that an attacker could trigger the flaw by influencing the ACPI device handling path, for example by providing crafted ACPI tables or by initiating a local or remote exploit that drives the system to enumerate the PIIX4 device during boot. The likely attack vector is local or remote access that can affect ACPI enumeration, leading to a potential kernel panic and denial of service rather than privilege escalation or data exfiltration.