The flaw arises in the ACPI button subsystem where a change to the notify handler type was not mirrored in the driver’s removal routine. When a button driver is unloaded, its legacy General‑Purpose Event handler remains registered, creating a resource‑management defect. If an ACPI event fires for that button after removal, the kernel attempts to invoke the stale handler, causing a crash and preventing the button from being re‑probed. This results in a kernel panic and loss of button functionality, effectively disabling the button and causing a denial of service that affects system stability.

Any Linux kernel derived from versions preceding commit a7e23ec17fee. The issue exists in all distributions built from those kernels, including kernel releases prior to 7.1 rc1. Distribution‑specific vendor products are not individually listed, so any user of a kernel before the fix is affected.

Based on the description, the likely attack vector is a local system user triggering an ACPI event after the button driver has been removed. The CVSS score of 5.5 indicates moderate severity, while the EPSS score is below 1 %, suggesting a low exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Successful exploitation would produce an immediate kernel panic and a local denial of service; remote exploitation appears unlikely.