This vulnerability occurs in the ACPI pfr_update subsystem of the Linux kernel. The query_capability() function copies four ACPI buffer objects, returned by firmware through the _DSM interface, into fixed-size 16‑byte fields on the kernel stack using memcpy without checking the source length. When the firmware provides a buffer longer than 16 bytes, the memcpy overruns the destination array, corrupting adjacent stack memory. The result is kernel memory corruption which can destabilize the kernel or trigger a crash. The weakness is a classic buffer overflow (CWE‑120).

Any Linux kernel release that has not yet incorporated the ACPI pfr_update length‑validation commit is affected. This includes stock kernels from distributions that still run the older code. Systems that load ACPI tables containing a _DSM entry that exercises pfr_update—especially if the firmware is not properly signed or validated—are susceptible.

The CVSS score of 5.7 classifies this issue as a moderate severity flaw. The EPSS score is reported as <1%, indicating a very low probability of exploitation; the flaw is not listed in the CISA KEV catalog. The likely attack vector is the ability to supply or modify firmware ACPI tables, a privilege normally restricted to firmware developers or users with physical access to the hardware. Consequently, the practical risk to a typical end‑user environment remains low, although a local privileged attacker who controls the firmware could potentially trigger kernel memory corruption.