The flaw arises in the Linux kernel’s ACPI HP BIOS configuration package parsing on x86 hosts. The code that validates a package’s element count then incorrectly forwards a count derived from the first element of the package—an ACPI string holding the name—to the type‑specific data parsers, rather than the validated count. As a consequence, the parser bounds itself against an unrelated string length, leading to a condition that reads past the end of the package buffer. Based on the description, it is inferred that this out‑of‑bounds read accesses kernel heap memory and can expose kernel data to anyone able to supply a crafted ACPI package, thereby leaking sensitive memory contents.

The vulnerability targets the Linux kernel as a whole for the Linux:Linux platform. No specific version range is provided, so any kernel branch that contains the hp‑bioscfg parsing code before the commit that corrects the element‑count forwarding may be affected. Distribution maintainers should check whether the commit hash referenced in the provided URLs appears in their kernel sources.

The likely attack vector is a malicious ACPI package supplied via firmware updates or through a local privilege escalation that permits modifying firmware or kernel configuration. The EPSS score of <1% indicates a very low probability of exploitation in the wild, and the CVSS score of 4.7 reflects moderate severity. This vulnerability is not listed in the CISA KEV catalog. Although current input validation prevents packages that are too short, an upcoming kernel change that relaxes this exploitation would still require privileged access to create the malicious package.