The Linux kernel’s ACPI subsystem contains a flaw where the handler object type is not validated in acpi_ev_has_default_handler() and acpi_ev_find_region_handler(). This oversight may allow an attacker who can influence ACPI handler registration to cause the kernel to use an improperly typed object, leading to arbitrary code execution or denial of service. The weakness is an input validation flaw.

Affected are Linux kernel installations. No specific version range is provided; administrators should check whether their running kernel incorporates the commit referenced in the advisory and consider updating to the latest stable kernel from their distribution.

The CVSS score is 8.4, and the EPSS score of < 1% reflects an extremely low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation would require the attacker to manipulate ACPI handler registration, which typically requires privileged access. Based on the description, this suggests that the likely attack vector is local privilege escalation; this inference is drawn from the requirement to influence ACPI handler registration and is not explicitly stated in the CVE data. Successful exploitation would grant kernel privileges, but remote exploitation is unlikely due to the need for local control.