CVE-2024-40984

What it actually does

NULL pointer dereference in ACPICA ACPI operation region mapping when a request spans a page boundary, resulting in partial mapping followed by an attempt to access the full requested length.

Why it matters to the business

Local denial-of-service crashes on Linux systems that exercise ACPI AML code with operation regions crossing page boundaries, reducing system availability; low urgency given absence from KEV and flat low EPSS.

How an attack unfolds

An attacker with local access crafts or triggers ACPI AML that requests an operation-region mapping crossing a page boundary; the kernel maps only up to the boundary but then performs a full-length read/write, dereferencing a NULL pointer and crashing the system.

How to fix it

Upgrade the Linux kernel to a version containing commit 435ecc978c3d5d0c4e172ec5b956dc1904061d98 or later; rebuild and reboot with the fixed kernel.

How to confirm the fix worked

Verify the running kernel contains commit 435ecc978c3d5d0c4e172ec5b956dc1904061d98; confirm absence of the reverted mapping logic in drivers/acpi/acpica; test with ACPI workloads that previously crossed page boundaries.

Typical attack path

1. Obtain local user access on a vulnerable Linux kernel
2. Trigger ACPI AML execution that requests an operation region spanning a page boundary
3. Induce NULL pointer dereference leading to kernel panic

How to detect it

Inspect kernel panic and oops logs for ACPICA or acpi_os_map_memory entries mentioning page-boundary mapping or NULL pointer dereference; correlate with ACPI AML execution timestamps.

• acpi_os_map_memory
• ACPICA: mapping multiple BARs
• NULL pointer dereference in acpi

What your security team should do

• Apply the upstream kernel fix or distribution update containing commit 435ecc978c3d5d0c4e172ec5b956dc1904061d98
• Reboot affected systems after patching
• Monitor kernel logs for ACPICA-related NULL dereference panics until remediation is complete