CVE-2026-97446: ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package()
In the Linux kernel, the following vulnerability has been resolved:
ACPICA: Fix NULL pointer dereference in acpinscustompackage()
acpinscustompackage() unconditionally dereferences the first element of the package to read the BIX version number, without checking for NULL:
if ((Elements)->Common.Type != ACPITYPEINTEGER)
When firmware returns a BIX package whose first element is an unresolvable reference, ACPICA evaluates that entry to NULL. acpinsremovenullelements() does not strip NULL entries for ACPIPTYPECUSTOM packages (fixed-position format would break if elements were shifted), so acpinscustompackage() sees the NULL and causes a crash.
Add a NULL check for the first element (version field) before dereferencing it. The caller then receives AEAMLOPERANDTYPE instead of crashing.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In acpi_ns_custom_package(), check whether the first package element is NULL before dereferencing it or reading the _BIX version; if it is NULL or its type is not ACPI_TYPE_INTEGER, return AE_AML_OPERAND_TYPE instead of dereferencing it.
Event History
Frequently Asked Questions
What conditions are required to trigger the crash?
Firmware must return a _BIX package whose first element is an unresolvable reference. ACPICA evaluates that element to NULL, and the vulnerable package-validation path dereferences it while reading the _BIX version field.
What is the impact after the fix?
Instead of crashing on the NULL element, the caller receives the ACPICA error AE_AML_OPERAND_TYPE. The fixed behavior preserves the package's fixed-position layout rather than removing the NULL entry.