The Linux kernel’s ACPI subsystem contained a flaw where the handler object type was not validated in acpi_ev_has_default_handler() and acpi_ev_find_region_handler(). This oversight may allow an attacker who can influence ACPI handler registration to cause the kernel to use an improperly typed object, leading to arbitrary code execution or denial of service. The weakness is an input validation flaw, consistent with CWE‑20.

Affected are Linux kernel installations. No specific version range is provided; administrators should check whether their running kernel incorporates the commit referenced in the advisory and consider updating to the latest stable kernel from their distribution.

The CVSS score is not disclosed and no EPSS data is available, so the precise severity is unknown. The vulnerability is not listed in CISA’s KEV catalog. Exploitation would require the attacker to manipulate ACPI handler registration, typically necessitating local privileged access. Successful exploitation would grant kernel privileges, but due to the need for local control, remote exploitation is unlikely.