CVE-2026-97446

In the Linux kernel, the following vulnerability has been resolved:

ACPICA: Fix NULL pointer dereference in acpi ns custom package()

acpi ns custom package() unconditionally dereferences the first element of the package to read the BIX version number, without checking for NULL:

if ((*Elements)->Common.Type != ACPI TYPE INTEGER)

When firmware returns a BIX package whose first element is an unresolvable reference, ACPICA evaluates that entry to NULL. acpi ns remove null elements() does not strip NULL entries for ACPI PTYPE CUSTOM packages (fixed-position format would break if elements were shifted), so acpi ns custom package() sees the NULL and causes a crash.

Add a NULL check for the first element (version field) before dereferencing it. The caller then receives AE AML OPERAND TYPE instead of crashing.