The Linux kernel contains a use‑after‑free flaw in ACPICA’s acpi_ns_build_normalized_path function. The code failed to validate the node parameter, allowing a dereference of a pointer that had already been freed. If an attacker can trigger the function with a crafted ACPI node, the dangling pointer could be exploited to execute arbitrary code in kernel mode. The weakness is a classic instance of improper memory use.

All Linux kernel releases that incorporated ACPICA before the node–validation change are susceptible. This includes kernels from any distribution that have not applied the patches identified by the developers’ Git commits. Versions that incorporated the fix in the commit series 21a735285, 96b2b616, or babb146c are considered safe; earlier builds remain vulnerable.

The CVSS score of 7.7 indicates high severity. The EPSS score is less than 1%, reflecting a very low but nonzero exploitation probability. The vulnerability is not listed in the CISA KEV catalog, so no large–scale exploitation has been reported. The likely attack vector is through crafted ACPI tables or device firmware, a scenario that is inferred from the nature of the bug; the explicit vector is not detailed in the description. An attacker with local or privileged access could use this flaw to gain kernel execution, potentially leading to full system compromise.