The Linux kernel’s ACPICA subsystem contains a NULL pointer dereference in the function acpi_ns_custom_package(). The routine unconditionally reads the first element of a custom ACPI package to obtain a _BIX version number, assuming that element is a valid integer. If firmware supplies a _BIX package whose first element is an unresolved reference, the element resolves to NULL and the dereference triggers a kernel panic. The patch adds a NULL check, converting the crash into an AE_AML_OPERAND_TYPE error, thereby preventing the crash but still allowing the bad package to be reported.

The affected product is the Linux kernel across all platforms that use the ACPICA driver to process ACPI _BIX packages. No particular release is listed, so any kernel that may encounter a malformed _BIX package from device firmware is potentially impacted.

Exploiting this flaw requires a device firmware that supplies a malformed _BIX package with an unresolved reference. The resulting kernel panic leads to a system reboot, constituting a denial‑of‑service attack. EPSS is not available and the vulnerability is not listed in CISA’s KEV catalogue. Because the flaw demands specific firmware behavior and is mitigated by the null check in the patch, the current risk is moderate for systems that remain unpatched while still susceptible to the agent’s fault. The execution would be local and would not grant code execution privileges beyond causing a crash.