The pac1934 driver in the Linux kernel performs a check for duplicate ACPI label entries. When a duplicate label is found, the driver writes a terminating byte and then accesses a missing label. This sequence can cause an out‑of‑bounds write that corrupts kernel memory. The CVE description does not claim that the corruption results in privilege escalation or arbitrary code execution; the impact is limited to kernel memory corruption that could lead to a crash or system instability.

The vulnerability is present in any Linux kernel that includes the pac1934 iio:adc driver, particularly kernels that compile the driver with ACPI support. Affected vendor products are Linux distributions that ship a kernel containing this driver. Specific version ranges are not listed; all kernels released before the fix should be considered vulnerable until patched.

The CVSS score of 4.1 indicates medium severity. The EPSS score of < 1% suggests a very low probability of exploitation. The vulnerability is not listed in CISA's KEV catalog, and no public exploitation has been reported. The flaw requires the attacker to interact with the pac1934 driver and provide malformed ACPI data or trigger the label duplication logic, so it is likely limited to local or targeted physical attacks. The resulting kernel memory corruption could manifest as a kernel panic or system instability.