The kernel driver for Panasonic laptops performs a sentinel write beyond the bounds of the pcc->sinf array, a CWE-787 vulnerability. This silent 4‑byte heap overflow can corrupt heap metadata and potentially allow a local user to cause undefined kernel behavior or privilege escalation. The bug arises when pcc->num_sifr equals the SINF package count, a case intentionally accepted by an off‑by‑one workaround for certain DSDT configurations. The vulnerability does not provide an immediate code‑execution path, but the resulting memory corruption poses a moderate risk if exploited. By inference, this overflow could be triggered through crafted ACPI tables presented to the driver.

The vulnerability exists in the Linux kernel's platform/x86 panasonic‑laptop driver. All kernel versions before the patch that include this driver are affected. In particular, older kernels that ship with the off‑by‑one workaround for Panasonic laptops' ACPI configuration are at risk. Users running Linux on Panasonic laptops or configuring this driver should verify their kernel version against the patch change.

The CVSS score is 4.1, classified as intermediate severity. The EPSS score is <1%, indicating a low likelihood of exploitation. The vulnerability is not listed in CISA's KEV catalog, indicating a low current exploitation probability. The likely attack vector would require local access to craft malicious ACPI or DSDT data; no public exploits have been reported. By inference, an attacker would need the ability to modify system ACPI tables to trigger the overflow. Patch deployment remains the best mitigation strategy, while other mitigations should be considered only if patching is not immediately feasible.