A null-pointer dereference occurs in acpi_processor_errata_piix4() when a first device lookup succeeds and a second lookup fails, overwriting the device pointer with NULL and causing dev_dbg() to dereference a NULL pointer. This flaw can trigger a kernel crash, effectively denying service to the system. The weakness is a classic null-pointer dereference (CWE‑476).

The vulnerability affects the Linux kernel, as indicated by the vendor and product names. No specific kernel versions are listed in the CNA data; however, any kernel implementing the defective acpi_processor_errata_piix4() code may be affected. Users running an unpatched kernel should verify whether the code path is enabled.

The CVSS score is not provided, and no EPSS value is available, so the exact severity cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Lack of a public exploit does not preclude risk; the flaw could be triggered by an attacker with local or remote access that can influence ACPI device handling, such as during normal boot or through crafted ACPI tables. The risk is principally a denial-of-service via kernel panic rather than data exfiltration or privilege escalation.