{"id":"CVE-2026-97446","revision":"84e4b2d3f0d241a79088b7c4f561f1bf","records":[{"revision":"84e4b2d3f0d241a79088b7c4f561f1bf","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-97446","aliases":[],"title":"ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: Fix NULL pointer dereference in acpi_ns_custom_package()\n\nacpi_ns_custom_package() unconditionally dereferences the first element\nof the package to read the _BIX version number, without checking for\nNULL:\n\n    if ((*Elements)->Common.Type != ACPI_TYPE_INTEGER)\n\nWhen firmware returns a _BIX package whose first element is an\nunresolvable reference, ACPICA evaluates that entry to NULL.\nacpi_ns_remove_null_elements() does not strip NULL entries for\nACPI_PTYPE_CUSTOM packages (fixed-position format would break if\nelements were shifted), so acpi_ns_custom_package() sees the NULL\nand causes a crash.\n\nAdd a NULL check for the first element (version field) before\ndereferencing it. The caller then receives AE_AML_OPERAND_TYPE\ninstead of crashing.","state":0,"publishedAt":"2026-09-24T16:04:01.612+00:00","modifiedAt":"2026-10-03T10:58:30.858+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/acpi/acpica/nsprepkg.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"7952d40240855932de01bbe81c02bf1416ec91d8\",\n                            \"lessThan\": \"fad537538cdfcdc51e41db61bbf9ebe5ed9427eb\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7952d40240855932de01bbe81c02bf1416ec91d8\",\n                            \"lessThan\": \"9936507ac0f2379787a2a805b11ab1cf0f241372\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7952d40240855932de01bbe81c02bf1416ec91d8\",\n                            \"lessThan\": \"644888605f55395e6012ed43e3ed643ef7ab5013\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7952d40240855932de01bbe81c02bf1416ec91d8\",\n                            \"lessThan\": \"08c5dee5da1d8d99b5a4e94db5a3d873c491771e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7952d40240855932de01bbe81c02bf1416ec91d8\",\n                            \"lessThan\": \"3762c6c8ae5073892d7cec736cc54270c7c9ce90\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7952d40240855932de01bbe81c02bf1416ec91d8\",\n                            \"lessThan\": \"3cbf096a478f4fa03953f0685ad28c9c82ce67cb\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7952d40240855932de01bbe81c02bf1416ec91d8\",\n                            \"lessThan\": \"f8d14b7bb0063bbbd86c0e4d73edb8cea7b362bc\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/acpi/acpica/nsprepkg.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.7\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.7\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.271\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.222\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.189\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.158\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.111\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.53\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/fad537538cdfcdc51e41db61bbf9ebe5ed9427eb","https://git.kernel.org/stable/c/9936507ac0f2379787a2a805b11ab1cf0f241372","https://git.kernel.org/stable/c/644888605f55395e6012ed43e3ed643ef7ab5013","https://git.kernel.org/stable/c/08c5dee5da1d8d99b5a4e94db5a3d873c491771e","https://git.kernel.org/stable/c/3762c6c8ae5073892d7cec736cc54270c7c9ce90","https://git.kernel.org/stable/c/3cbf096a478f4fa03953f0685ad28c9c82ce67cb","https://git.kernel.org/stable/c/f8d14b7bb0063bbbd86c0e4d73edb8cea7b362bc"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-97446","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-97446","identifiers":["CVE-2026-97446"]},"retained":false,"historicalAffected":[]}],"coverage":[]}