The vulnerability resides in the Linux kernel’s ACPICA component, specifically in the acpi_ps_parse_loop function. The code incorrectly checks the condition for the AML_ELSE_OP operation, allowing the parser to access memory beyond the intended bounds. This out-of-bounds access can corrupt kernel memory or cause the kernel to crash, potentially resulting in a denial of service. No additional arbitrary code execution capability is described in the official data.

All Linux kernel configurations that have not yet incorporated the ACPICA patch are affected. Systems running any mainline kernel version prior to the commits referenced in the advisory – including those packaged by distributions that have not yet released a patched kernel – remain in risk until the kernel is updated. The flaw is limited to systems that load ACPI tables at boot or during runtime.

The CVSS score of 5.5 indicates moderate severity. The EPSS score of < 1% suggests a low probability of exploitation with current threat data. Exploitation requires manipulation of ACPI tables, which typically demands local privileged access or a compromised firmware environment. The likely attack vector is therefore local or firmware‑level; remote exploitation without firmware compromise is unlikely.