CVE-2026-97446 Linux CVE debrief

Who should care

Defenders responsible for Linux kernel systems, especially those handling ACPI packages, should assess exposure and prioritize patching. They should review system configurations, monitor system logs for potential issues, and consider compensating controls for exposed systems. Security teams should track exceptions, retest remediated assets, and verify evidence of patching.

Why it matters

A NULL pointer dereference vulnerability in the Linux kernel's ACPICA requires defenders to verify and apply patches, review system configurations, and monitor system logs.

• Potential system crashes or errors due to NULL pointer dereference
• Need to verify and apply patches for Linux kernel systems
• Importance of monitoring system logs for potential issues

Technical summary

The acpi_ns_custom_package() function in the Linux kernel's ACPICA did not check for NULL before dereferencing the first element of a package. This could cause a crash when firmware returns a _BIX package with an unresolvable reference. A patch has been applied to add a NULL check. The patch ensures that the function handles _BIX packages with unresolvable references correctly, preventing potential system crashes. Defenders should prioritize verifying and applying patches for Linux kernel systems, especially those handling ACPI packages.

Defensive priority

Defenders should prioritize verifying and applying patches for Linux kernel systems, especially those handling ACPI packages.

Recommended defensive actions

• Verify and apply Linux kernel patches for ACPICA
• Review system configurations for ACPI package handling
• Monitor system logs for potential crashes or errors
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but specific exploitation or impact data is not available. The vulnerability has been addressed with a patch that adds a NULL check. Defenders should verify and apply patches for Linux kernel systems, especially those handling ACPI packages. The affected product deployments should be reviewed for exposure, and compensating controls should be considered for exposed systems.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.