The Linux kernel on arm64 fails to validate CPU presence during hotplug, causing a null kobject warning when cpuhp_smt_enable() processes CPUs marked present but not yet registered. This results in sysfs warnings and may disrupt normal boot or lead to instability. While there is no direct evidence of code execution, the inconsistency can cause service interruption or a denial of service under misconfigured conditions.

All arm64 Linux kernel users that boot with ACPI support and specify a maxcpus count higher than the number of physically present CPUs are potentially affected. The issue arises from smp_prepare_cpus marking every enumerated CPU as present regardless of the MADT flags, leading to unregistered CPUs appearing in the present mask. The vulnerability applies to any distribution using a kernel that does not include the recent patch, independent of vendor.

No CVSS score is provided and the EPSS metric is unavailable, so the exact exploitation probability is uncertain. The vulnerability is not listed in CISA KEV, indicating no known widespread exploitation. The attack vector is local and would require an attacker to control kernel boot parameters or modify the kernel image. Given these constraints, the risk is low to moderate, with the primary danger being a potential denial of service via repeated sysfs errors.