The vulnerability in the Linux kernel ACPI NFIT core arises from improper cleanup when acpi_nfit_init() fails after adding an acpi_desc object to the acpi_descs list. Without adding the acpi_nfit_shutdown() devm action, the object remains in the list even after being freed, causing a dangling pointer. Subsequent ACPI Machine Check Exceptions invoke nfit_handle_mce(), which iterates over acpi_descs and triggers a use-after-free. Another related issue occurs when acpi_nfit_probe() installs a notify handler but does not allocate or initialize the acpi_desc object properly, leading to similar use-after-free risks upon driver removal. The patch addresses these by calling acpi_nfit_shutdown() on failures, adding a remove callback, and adding NULL checks in shutdown and unregister functions.

The vulnerability can cause use-after-free conditions in the Linux kernel ACPI NFIT subsystem, potentially leading to kernel crashes or undefined behavior when handling ACPI Machine Check Exceptions. This could affect system stability and reliability but no direct exploit or privilege escalation details are provided.

A fix has been implemented in the Linux kernel to address this issue by improving error cleanup and adding proper shutdown callbacks. Users should apply the official kernel updates that include this fix. Since this is a kernel-level vulnerability, updating to a patched kernel version is the recommended mitigation. Patch status is not explicitly stated here; check the Linux kernel vendor advisory or source repository for the specific fixed versions and apply updates accordingly.