In the Linux kernel, the ACPI NFIT driver has a flaw that leaves a dangling descriptor object on a global list when initialization fails or when a probe path finishes without creating the descriptor. Later, an ACPI Machine Check Exception triggers the kernel routine that iterates over this list and dereferences the freed entry, causing a use‑after‑free and kernel crash. The weakness is classified as a use‑after‑free, CWE‑825.

All Linux kernel builds that include the NFIT driver and implement the default ACPI initialization path are affected. The issue is not tied to a specific kernel version; any kernel lacking the committed fixes is vulnerable.

The CVSS score of 7 signals high severity, but the EPSS score is below 1 %, indicating a very low likelihood of targeted exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, an attacker would need to trigger an ACPI Machine Check Exception or otherwise force the NFIT driver into an error pathway that leaves the descriptor dangling, a scenario that typically requires direct hardware or firmware manipulation. If achieved, the exploit would cause a kernel crash, resulting in denial of service or potential data loss.