CVE-2026-8035: NI-PAL Kernel Driver NULL Pointer Dereference DoS Vulnerability

Technical summary

The vulnerability resides in improper input validation within the NI-PAL kernel driver (CWE-476: NULL Pointer Dereference). When the driver processes user-supplied input without sufficient validation, an authenticated local attacker can craft input that causes the driver to dereference a NULL pointer, triggering a kernel-level crash. The attack vector is local, requires prior authentication, and does not require user interaction. The impact is limited to availability—the system becomes unavailable until reboot, but code execution and privilege escalation are not possible through this mechanism.

Business impact

Availability disruptions caused by this vulnerability could impact production environments where NI-PAL is integrated into automation, measurement, or control systems. Manufacturing facilities, test laboratories, or embedded real-time systems relying on NI Linux Real-Time or Windows systems with PAL drivers face risk of unexpected downtime. While the vulnerability does not enable data theft or unauthorized access, the denial-of-service impact may interrupt critical operations until systems are restarted and patched.

Affected systems

This vulnerability affects NI-PAL version 26.3.0 and prior on Windows and Linux operating systems. The scope extends to systems running NI Linux Real-Time that incorporate the vulnerable driver. Any deployment where authenticated local users have access to the NI-PAL driver interface is at risk. Cross-platform exposure (Windows, Linux, and NI's real-time Linux) means both enterprise and embedded environments require attention.

Exploitability

Exploitation requires local system access with authenticated user privileges—a threat actor cannot trigger this remotely over the network. An insider, compromised local account, or user with physical access to the system could deliberately or accidentally invoke a crash by submitting malformed input to the NI-PAL driver. The attack requires no user interaction and executes reliably once triggered. While the barrier to entry is moderate (authentication required), the simplicity of the NULL pointer dereference and the predictable crash behavior make this straightforward to exploit once local access is obtained.

Remediation

Upgrade NI-PAL to the latest patched version released after 26.3.0. National Instruments has published updates addressing this input validation flaw. Verify the specific patch version against the vendor advisory and test thoroughly in a non-production environment before deploying to operational systems. In parallel, restrict local user privileges to the NI-PAL driver interface where possible through driver-level access controls or operating system security policies.

Patch guidance

Obtain the latest NI-PAL driver update from National Instruments' official download portal or update utility. The advisory will specify the minimum patched version required (verify against the vendor advisory for exact build numbers). Patch deployment should be coordinated with system downtime windows, as driver updates typically require a system restart. Test the patched driver in a staging environment with representative workloads to confirm stability and compatibility with dependent applications before rolling out to production systems. Document the patch version and deployment date for compliance and audit purposes.

Detection guidance

Monitor kernel logs and system event logs for NULL pointer dereference crashes or unexpected NI-PAL driver terminations. On Linux systems, check dmesg or journalctl for kernel panic messages mentioning the PAL driver; on Windows, examine the Event Viewer for driver fault events. Behavioral anomalies such as repeated system reboots without user initiation or unplanned availability interruptions in NI-dependent applications warrant investigation into potential exploitation. Correlate timing of crashes with authentication logs to identify whether a specific user account is triggering the condition.

Why prioritize this

Although this vulnerability carries a CVSS 3.1 score of 7.1 (HIGH severity), it should be prioritized based on your deployment model. Organizations with mission-critical NI-PAL integrations in manufacturing, test automation, or embedded real-time systems should treat it as urgent because unplanned downtime carries significant operational cost. However, organizations with limited or non-critical NI-PAL usage can address it within a standard maintenance cycle. The lack of CISA KEV listing and the requirement for authenticated local access reduce the urgency compared to unauthenticated remote code-execution flaws, but the availability impact justifies prompt attention for affected deployments.

Risk score, explained

The CVSS 3.1 score of 7.1 reflects the combination of: (1) local attack vector requiring authentication, limiting exposure; (2) low attack complexity—NULL pointer dereferences are typically trivial to trigger once input validation is bypassed; (3) no confidentiality impact, preserving data secrecy; (4) high integrity and availability impact, as the system crash may interrupt ongoing processes and require manual intervention to restore service. The score appropriately reflects a serious but not critical threat in environments where local privileged access is already restricted or monitored.

Frequently asked questions