CVE-2026-45982: Linux Kernel NULL Pointer Vulnerability

CVE-2026-45982 Overview

CVE-2026-45982 is a NULL pointer dereference vulnerability in the Linux kernel's ACPICA (Advanced Configuration and Power Interface Component Architecture) subsystem. The flaw exists in the acpi_ev_address_space_dispatch() function, where a missed execution path failed to validate a pointer before use. Kernel maintainers resolved the issue by adding a new check to cover the previously unguarded path. The vulnerability has been patched across multiple stable kernel branches via upstream commits.

Critical Impact
A NULL pointer dereference in kernel-mode ACPI event handling can trigger a kernel oops, leading to denial of service on affected Linux systems.

Affected Products

Linux kernel (mainline) — ACPICA subsystem
Linux kernel stable branches receiving the backported fix
Distributions shipping unpatched kernels with the ACPICA address space dispatcher

Discovery Timeline

2026-05-27 - CVE-2026-45982 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45982

Vulnerability Analysis

The vulnerability resides in acpi_ev_address_space_dispatch(), a core ACPICA routine that dispatches operation region accesses to registered address space handlers. ACPI address space handlers mediate reads and writes against hardware resources such as system memory, system I/O, PCI configuration space, and embedded controllers. The function previously assumed that all execution paths reaching certain pointer operations had valid, initialized structures. One execution path bypassed that assumption, allowing a NULL pointer to be dereferenced during dispatch. The upstream fix introduces an explicit NULL check to guard the missed path before the pointer is used.

Root Cause

The root cause is missing input validation [CWE-476] on a pointer used inside acpi_ev_address_space_dispatch(). The function did not verify the pointer along one control-flow branch before dereferencing it. Triggering the unchecked branch causes the kernel to read from a NULL address in kernel context.

Attack Vector

The attack vector requires execution of ACPI control methods that exercise the vulnerable dispatch path. This is typically reachable through firmware-driven ACPI activity, kernel ACPI interpreter operations, or interactions with operation regions backed by handlers that hit the missed code path. Successful triggering produces a kernel NULL pointer dereference, resulting in a kernel oops and potential system instability or denial of service. See the upstream patch references for the specific control-flow details corrected by the fix.

Detection Methods for CVE-2026-45982

Indicators of Compromise

Kernel oops messages referencing acpi_ev_address_space_dispatch in the call trace within dmesg or /var/log/kern.log.
Unexpected kernel panics or system reboots correlated with ACPI activity, firmware events, or thermal and power management transitions.
Crash dumps showing a NULL pointer dereference faulting address inside the ACPICA event dispatch path.

Detection Strategies

Inventory running kernel versions across the fleet and compare against the fixed commits referenced in git.kernel.org stable trees.
Monitor kernel ring buffer output for ACPI subsystem warnings and BUG traces involving address space handlers.
Aggregate kernel crash telemetry centrally to identify clusters of acpi_ev_address_space_dispatch faults across hosts.

Monitoring Recommendations

Forward kern.log and journald kernel facility entries to a centralized logging or SIEM platform for trace correlation.
Enable kdump to capture crash dumps when kernel oops events occur for offline root-cause analysis.
Track kernel package versions through configuration management to confirm patch deployment status.

How to Mitigate CVE-2026-45982

Immediate Actions Required

Update affected Linux systems to a kernel build that includes the upstream ACPICA fix for acpi_ev_address_space_dispatch().
Apply vendor-supplied kernel updates from your distribution as soon as they are released for the affected stable series.
Reboot systems after kernel package installation to load the patched kernel image.

Patch Information

The fix is available in the following upstream commits across mainline and stable branches: Kernel Git Commit 56024db, Kernel Git Commit 7d99cbe, Kernel Git Commit b24595b, Kernel Git Commit cce3545, Kernel Git Commit f2cf475, and Kernel Git Commit f851e03. Track your distribution advisories to identify the corresponding packaged kernel release.

Workarounds

No vendor-supplied workaround is documented. Patching the kernel is the supported remediation.
Where patching is delayed, restrict workloads on affected hosts that exercise ACPI operation regions through custom drivers or firmware updates.
Maintain kdump and automated reboot policies to minimize downtime if a NULL pointer dereference is triggered before patching.

bash

# Verify running kernel and update on Debian/Ubuntu
uname -r
sudo apt update && sudo apt install --only-upgrade linux-image-$(uname -r | cut -d- -f3-)
sudo reboot

# Verify running kernel and update on RHEL/Rocky/AlmaLinux
uname -r
sudo dnf update kernel
sudo reboot