The flaw arises in the ACPI button subsystem, where a change to the notify handler type was not mirrored in the driver’s removal routine. When a button driver is unloaded, its legacy General‑Purpose Event handler remains registered, creating a resource‑management defect (CWE‑772). If a subsequent ACPI event fires for that button, the kernel attempts to invoke the stale handler, triggering a crash. This results in a kernel panic and the button driver can no longer be probed, effectively disabling the button’s functionality. The impact is a denial of service that affects system stability and device usability.

The issue exists in any Linux kernel derivative that predates commit a7e23ec17fee. No vendor‑specific versions are listed, so all distributions built from earlier kernel releases are susceptible.

Based on the description, the likely attack vector is a local system user triggering an ACPI event after the button driver has been removed. The base CVSS score is 5.5, indicating moderate severity, while the EPSS score is less than 1 % and the vulnerability is not in CISA’s KEV catalog. Successful exploitation would cause an immediate kernel panic and a local denial of service for the affected button functionality; remote exploitation is improbable.