CVE-2024-46822

What it actually does

NULL pointer dereference in get_cpu_for_acpi_id() when cpu_madt_gicc[cpu] remains NULL after an MPIDR check failure in acpi_map_gic_cpu_interface() on arm64 ACPI systems.

Why it matters to the business

Kernel panic or denial of service on Linux systems using ACPI on arm64 hardware, with low likelihood given no established trigger path and minimal EPSS; older kernels remain exposed until patched.

How an attack unfolds

An attacker would need to induce an MPIDR check failure during ACPI CPU initialization or vCPU hotplug to leave a NULL entry that later causes a dereference when indexing into a cpumask; no public path or exploitation by listed threat actors has been confirmed.

How to fix it

Update the Linux kernel to commit f57769ff6fa7f97f1296965f20e8a2bb3ee9fd0f or later stable releases containing the hardening of get_cpu_for_acpi_id(); apply vendor-specific backports where available.

How to confirm the fix worked

Confirm the patch is present by checking for the NULL check before cpu_madt_gicc[cpu] access in get_cpu_for_acpi_id(); run kernel build with ACPI and arm64 enabled and verify no NULL dereference under hotplug or MADT parsing stress.

Typical attack path

1. Trigger ACPI GICC table processing on arm64 with a missing or invalid CPU entry
2. Cause acpi_map_gic_cpu_interface() MPIDR check to fail leaving cpu_madt_gicc[cpu] NULL
3. Invoke get_cpu_for_acpi_id() to dereference the NULL pointer
4. Induce kernel oops or panic

How to detect it

Inspect kernel logs for NULL pointer dereference oops mentioning get_cpu_for_acpi_id or acpi_map_gic_cpu_interface; correlate with ACPI MADT parsing or CPU hotplug events; no specific post-exploitation artifacts are known.

What your security team should do

• Prioritize kernel upgrades on arm64 ACPI systems within standard change windows given low EPSS and no KEV listing
• Monitor for upstream stable releases containing f57769ff6fa7f97f1296965f20e8a2bb3ee9fd0f
• Review vCPU hotplug and ACPI CPU online paths in virtualization or cloud workloads for additional hardening