The flaw exists in the Linux kernel’s ATK hardware monitoring driver. The function atk_ec_present() reads the first element of a sub‑package retrieved from an ACPI method without first verifying that the sub‑package contains any elements. Since the ACPI library allocates the element array exactly to the package count, an empty sub‑package (count = 0) results in a read beyond the allocated array boundaries. This out‑of‑bounds read can expose unintended memory contents or trigger a kernel fault, potentially leading to a crash. The vulnerability represents a missing bounds check before dereferencing a pointer, which is a classic buffer over‑read weakness. The potential for information disclosure or a denial‑of‑service outcome is inferred because an out‑of‑bounds read in kernel space can leak data or destabilize the kernel.

All Linux kernel builds that include the ASUS ATK hardware monitoring driver are potentially affected. The vulnerability is located in core kernel code and is not limited to a specific distribution or kernel version; any system running the affected driver can be impacted, regardless of additional configuration.

The CVSS score of 8.4 reflects high severity. The EPSS score of < 1 % implies a very low probability of exploitation. Based on the description, it is inferred that the likely attack vector is through compromised or tampered firmware that supplies a malformed ACPI package. This scenario is inferred to be difficult to achieve under normal circumstances. The vulnerability is not listed in CISA’s KEV catalog, yet the low EPSS does not eliminate the risk of a targeted exploit against firmware‑compromised devices.