CVE-2026-97446

A flaw was found in the Linux kernel's ACPI (Advanced Configuration and Power Interface) component. When the system processes a malformed ACPI package provided by firmware with an unresolvable reference, the kernel dereferences a NULL pointer without prior validation. This issue leads to a kernel crash, resulting in a Denial of Service (DoS).

A low-impact NULL pointer dereference flaw was found in the Linux kernel ACPICA code, in acpi_ns_custom_package(). When firmware returns a _BIX package whose first element is an unresolvable reference, ACPICA evaluates that entry to NULL; because acpi_ns_remove_null_elements() does not strip NULL entries from ACPI_PTYPE_CUSTOM packages, the version element is dereferenced without validation, causing a kernel crash and resulting in denial of service. No confidentiality or integrity impact is demonstrated, as the defect only crashes the kernel.

Red Hat Enterprise Linux 8, 9, and 10 (kernel and kernel-rt), Red Hat In-Vehicle OS, and OpenShift Container Platform RHEL CoreOS builds are affected. The fix is currently deferred to a future update for these streams, so the residual risk is a kernel panic on systems whose ACPI firmware supplies such a malformed _BIX package, for example systems with attacker-controlled or malformed firmware, or virtual machines whose platform firmware tables are controlled by the host. Red Hat Enterprise Linux 6 and 7 Extended Life Cycle Support streams are not affected because the vulnerable code is not present in those kernels.

Although the Red Hat CVSS:3.1 base score for the kernel is 5.5 (Moderate), Red Hat rates the overall impact of this flaw as low because triggering it requires malformed or attacker-controlled ACPI firmware data rather than actions available to an ordinary unprivileged local user.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.