CVE-2026-97446

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package()<br /> <br /> acpi_ns_custom_package() unconditionally dereferences the first element<br /> of the package to read the _BIX version number, without checking for<br /> NULL:<br /> <br /> if ((*Elements)-&gt;Common.Type != ACPI_TYPE_INTEGER)<br /> <br /> When firmware returns a _BIX package whose first element is an<br /> unresolvable reference, ACPICA evaluates that entry to NULL.<br /> acpi_ns_remove_null_elements() does not strip NULL entries for<br /> ACPI_PTYPE_CUSTOM packages (fixed-position format would break if<br /> elements were shifted), so acpi_ns_custom_package() sees the NULL<br /> and causes a crash.<br /> <br /> Add a NULL check for the first element (version field) before<br /> dereferencing it. The caller then receives AE_AML_OPERAND_TYPE<br /> instead of crashing.