CVE-2026-45982

What it actually does

This vulnerability is a NULL pointer dereference in the Linux kernel ACPICA code path, specifically in acpi_ev_address_space_dispatch(). A local user or local process with the ability to trigger the affected ACPI address-space handling path may cause the kernel to dereference a NULL pointer, resulting in a kernel oops, panic, or system crash. The impact is limited to availability; the CVSS vector indicates no confidentiality or integrity impact and requires local access with low privileges and no user interaction.

Why it matters to the business

Successful exploitation can crash affected Linux systems, interrupting applications and services running on them. For servers, appliances, workstations, or embedded systems that depend on stable kernel operation, this may cause service outages, failed jobs, degraded reliability, and operational disruption. The vulnerability is not currently listed in CISA KEV, has low EPSS, and has no known mature public exploit, so urgency is lower than actively exploited kernel flaws, but it should still be addressed through normal kernel maintenance because availability issues in the kernel can have broad operational consequences.

How an attack unfolds

An attacker first obtains local access to an affected Linux system, such as through a low-privileged account, compromised application user, container escape-adjacent local foothold, or other local execution path. The attacker then triggers the vulnerable ACPICA execution path that reaches acpi_ev_address_space_dispatch() without the missing NULL check. When the kernel attempts to use the NULL pointer, the system records a kernel fault and may panic or become unstable depending on kernel configuration, panic-on-oops settings, workload, and recovery behavior. The attacker’s objective is denial of service rather than code execution: the practical outcome is crashing or destabilizing the host to disrupt workloads.

How to fix it

Upgrade the Linux kernel to a vendor-provided version that includes the ACPICA fix for the NULL pointer dereference in acpi_ev_address_space_dispatch(). Because no exact fixed package versions were provided, use the relevant distribution or appliance vendor advisory to identify the corrected kernel package for each affected release stream. After installing the updated kernel, reboot systems into the fixed kernel; merely installing the package is not sufficient if the vulnerable kernel remains running. Where immediate patching is not possible, reduce exposure by limiting local shell access, enforcing least privilege, restricting untrusted code execution, hardening container and workload isolation, and ensuring watchdog/reboot policies are appropriate for availability requirements. Mitigations should be treated as temporary because the flaw is in kernel code.

How to confirm the fix worked

Confirm remediation by verifying that systems are running a kernel build containing the upstream or vendor backport for the ACPICA acpi_ev_address_space_dispatch() NULL-check fix. Compare the running kernel version from uname -r with the vendor advisory’s fixed kernel package version, and verify the booted kernel matches the installed fixed package after reboot. Review package manager output to ensure the corrected kernel is installed and older vulnerable kernels are not the default boot target. For source-based or custom kernels, inspect the ACPICA event/address-space dispatch code to confirm the added NULL check is present and rebuild/reboot into the corrected kernel. Exposure can be assessed by inventorying Linux systems, mapping kernel versions to vendor advisories, and prioritizing systems that allow local user access or run untrusted workloads.

Typical attack path

1. Gain local, low-privileged execution on an affected Linux system.
2. Identify that the running kernel includes the vulnerable ACPICA code path.
3. Trigger ACPI address-space handling in a way that reaches the missed NULL-check path in acpi_ev_address_space_dispatch().
4. Cause the kernel to dereference a NULL pointer.
5. Induce a kernel oops, panic, reboot, or service outage, depending on system configuration.

How to detect it

To determine whether this vulnerability may already have been exploited, review kernel logs and system journals for NULL pointer dereference, kernel oops, panic, or unexpected reboot events involving ACPICA, ACPI address-space handling, or acpi_ev_address_space_dispatch(). Useful log sources include dmesg output, systemd journal, /var/log/kern.log, /var/log/messages, /var/log/syslog, crash dump metadata, kdump/vmcore records, hypervisor reset events, and endpoint telemetry that records kernel panics or abnormal shutdowns. Focus on timestamps preceding unexplained outages or reboots, especially where a low-privileged local user, workload, or untrusted process was active shortly before the crash. Because this is a denial-of-service vulnerability and no public exploit maturity is reported, artifacts may be limited to crash traces rather than persistent files or network indicators. Look for repeated crashes with similar ACPI stack traces, kernel call traces naming acpi_ev_address_space_dispatch(), or panic/oops messages indicating a NULL pointer dereference in ACPI/ACPICA code.

• acpi_ev_address_space_dispatch
• NULL pointer dereference
• kernel NULL pointer dereference
• BUG: kernel NULL pointer dereference
• Oops: 0000
• Kernel panic - not syncing
• ACPI Error
• ACPI Exception
• ACPICA
• Call Trace:
• RIP: acpi_ev_address_space_dispatch
• /var/log/kern.log
• /var/log/messages
• /var/log/syslog
• journalctl -k
• dmesg
• /var/crash
• vmcore
• kdump

What your security team should do

• Inventory Linux systems and identify running kernel versions, not only installed kernel packages.
• Check the relevant Linux distribution or appliance vendor advisories for the fixed kernel build that contains the ACPICA acpi_ev_address_space_dispatch() NULL pointer dereference fix.
• Patch affected systems during the next appropriate maintenance window and reboot into the fixed kernel.
• Prioritize systems where many users have local access, systems running untrusted workloads, shared compute platforms, and high-availability production hosts where a crash has material operational impact.
• Restrict local interactive access and untrusted code execution on systems that cannot be patched immediately.
• Review kernel panic, oops, and reboot telemetry for evidence of unexplained crashes involving ACPI or acpi_ev_address_space_dispatch().
• Ensure monitoring alerts on unexpected Linux reboots, kernel panics, and repeated oops events.
• Remove or de-prioritize obsolete vulnerable kernels from bootloader defaults after confirming the fixed kernel is stable.