The vulnerability stems from platform drivers that assume the presence of an ACPI companion object during probe. When a driver is forced to match a device without an ACPI companion, the driver may dereference a null pointer, leading to a kernel panic. This null pointer dereference is a classic denial‑of‑service flaw that disrupts system availability and can propagate to critical services relying on the kernel.

All Linux kernel releases that have not incorporated the fix for the ACPI COMPANION NULL check. The issue affects every distribution that uses the upstream kernel without the patch, as the same driver code is common to all platforms. No specific vendor or version is known to be unaffected from the input data, so any kernel predating the provided commits is potentially vulnerable.

The EPSS score indicates a very low probability of exploitation, and the flaw is not listed in the CISA KEV catalog. However, the nature of the defect – a hard kernel crash – means that once triggered, the impact is catastrophic for the affected host. The likely attack vector is local system compromise or potentially remote if an attacker can trigger an ACPI‑enabled device to load the offending driver. The CVSS score of 5.5 indicates moderate severity, but the kernel panic signifies high impact when the flaw is exercised.