The Linux kernel’s ACPICA subsystem contains a NULL pointer dereference in the function acpi_ns_custom_package(). The routine unconditionally reads the first element of a custom ACPI package to obtain a _BIX version number, assuming that element is a valid integer. If firmware supplies a _BIX package whose first element is an unresolved reference, the element resolves to NULL and the dereference triggers a kernel panic. The patch adds a NULL check, converting the crash into an AE_AML_OPERAND_TYPE error, thereby preventing the crash but still allowing the bad package to be reported.

The affected product is the Linux kernel across all platforms that use the ACPICA driver to process ACPI _BIX packages. No particular release is listed, so any kernel that may encounter a malformed _BIX package from device firmware is potentially impacted.

Exploiting this flaw requires a device firmware that supplies a malformed _BIX package with an unresolved reference. The resulting kernel panic leads to a system reboot, constituting a denial‑of‑service attack. The EPSS score indicates a very low but nonzero exploitation probability (<1%). It is not listed in CISA’s KEV catalogue. Because the flaw demands specific firmware behavior and is mitigated by the null check in the patch, the current risk is moderate for systems that remain unpatched while still susceptible to the agent’s fault. The CVSS score of 5.5 rates the flaw as medium, supporting the assessment of moderate risk. The execution would be local and would not grant code execution privileges beyond causing a crash.