The vulnerability is a buffer overflow in the Linux kernel’s ACPICA implementation, specifically in the acpi_ex_load_table_op() routine. The function fails to validate the length of the OEM ID and Table ID strings contained in ACPI tables before copying them, allowing an attacker to supply a maliciously crafted ACPI table that overflows the destination buffer. This overflow can corrupt kernel memory, potentially enabling arbitrary code execution or a denial‑of‑service condition. The weakness is a classic memory buffer overrun, identified as CWE-119.

All Linux kernel installations that include the unpatched ACPICA component are affected. The issue exists in kernel versions that pre‑date the commit that added stricter OEM ID and Table ID validation. Exact version ranges are not listed in the CVE data, so any deployed kernel that has not yet applied the upstream patch should be considered vulnerable.

Because the flaw occurs in kernel space and requires the use of an ACPI table supplied by firmware or hardware, the attack vector is most likely local or supply‑chain based. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, so the current exploitation probability is unknown. However, buffer overflows in the kernel are typically rated high severity and can lead to privilege escalation or system compromise if successfully leveraged.