AZL-103985
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-103985.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-103985
- Upstream
- Published
- 2026-09-24T17:17:22Z
- Modified
- 2026-09-27T05:34:32Z
- Summary
- CVE-2026-97446 affecting package kernel 6.6.157.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package()
acpi_ns_custom_package() unconditionally dereferences the first element of the package to read the _BIX version number, without checking for NULL:
if ((*Elements)->Common.Type != ACPI_TYPE_INTEGER)When firmware returns a _BIX package whose first element is an unresolvable reference, ACPICA evaluates that entry to NULL. acpi_ns_remove_null_elements() does not strip NULL entries for ACPI_PTYPE_CUSTOM packages (fixed-position format would break if elements were shifted), so acpi_ns_custom_package() sees the NULL and causes a crash.
Add a NULL check for the first element (version field) before dereferencing it. The caller then receives AE_AML_OPERAND_TYPE instead of crashing.
- References