In the Linux‑kernel ACPI subsystem, a race condition can cause the routine that obtains the first physical device linked to an ACPI device to return a stale pointer. The routine may release the device’s lock after a concurrent unbinding operation while the pointer is still in use, and most callers then dereference that pointer, leading to a classic use‑after‑free scenario that corrupts memory or crashes the kernel.

All Linux kernel installations are potentially affected until the patch that introduces the function acpi_bus_get_primary_device and adds reference counting is applied. The change is generic to the kernel’s ACPI driver stack and does not target a specific release series.

The vulnerability does not yet appear in CISA’s KEV catalog and its EPSS score is not available, indicating limited public exploitation data. However, use‑after‑free bugs can enable attackers to corrupt memory, crash privileged processes, or, in the worst case, allow arbitrary code execution if the corrupted memory is exploitable. Without a publicly documented exploit, the risk remains moderate but not negligible, especially for systems exposed to untrusted ACPI input.