Confirmed -- and I can hopefully shed some light on this as well.

Seems that this (acx wireless) is the common thread/culprit:  acx_l_process_authen+0x124/0x380

Background:

I had an RT2500 wireless card on WEP that used to work on 8.04 but doesn't even link on 8.10 (separate problem) and so I replaced the RT2500 with this Netgear WG311 (Texas Instruments) based card.  It gives a kernel panic and doesn't even survive boot.  I plugged in a null modem, which allowed me to spot the culprit, and a google led me here.

I get the same:

[  139.601803] BUG: unable to handle kernel NULL pointer dereference at 00000029
[  139.605751] IP: [<e0a68864>] :acx:acx_l_process_authen+0x124/0x380           
[  139.605751] Oops: 0000 [#1] SMP                                              
[  139.605751] Modules linked in: i810 drm bridge stp bnep rfcomm sco l2cap blue
tooth nfsd lockd nfs_acl auth_rpcgss sunrpc exportfs ppdev speedstep_lib cpufreq
_stats cpufreq_powersave cpufreq_ondemand freq_table cpufreq_conservative cpufre
q_userspace video output wmi sbs sbshc pci_slot container battery ipv6 af_packet
 iptable_filter ip_tables x_tables ac lp loop snd_intel8x0 snd_ac97_codec ac97_b
us snd_pcm_oss snd_mixer_oss snd_pcm snd_seq_dummy evdev snd_seq_oss parport_pc 
parport snd_seq_midi snd_rawmidi snd_seq_midi_event psmouse serio_raw snd_seq ac
x snd_timer snd_seq_device snd button iTCO_wdt soundcore pcspkr iTCO_vendor_supp
ort snd_page_alloc shpchp intel_agp pci_hotplug agpgart ext3 jbd mbcache usbhid 
hid sr_mod cdrom sd_mod crc_t10dif usb_storage libusual sg pata_acpi ata_piix at
a_generic uhci_hcd libata usbcore scsi_mod e100 mii dock thermal processor fan f
bcon tileblit font bitblit softcursor fuse                                      
[  139.605751]                                                                  
[  139.605751] Pid: 0, comm: swapper Not tainted (2.6.27-11-generic #1)         
[  139.605751] EIP: 0060:[<e0a68864>] EFLAGS: 00010002 CPU: 0                   
[  139.605751] EIP is at acx_l_process_authen+0x124/0x380 [acx]                 
[  139.605751] EAX: 00000000 EBX: dd174480 ECX: 00000006 EDX: 00000000          
[  139.605751] ESI: 00000029 EDI: de6852fc EBP: c04a9e18 ESP: c04a9dd8          
[  139.605751]  DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068                    
[  139.605751] Process swapper (pid: 0, ti=c04a8000 task=c0470340 task.ti=c04a80
00)                                                                             
[  139.605751] Stack: c04a9e08 16f64dba c04a9df0 c01136c0 00025884 de6852fc c04a
9e40 dd17474c                                                                   
[  139.605751]        de6852f2 00000000 c8423e90 00000000 00000000 c04a9e40 0000
001e c04a9e58                                                                   
[  139.605751]        c04a9e84 e0a696c1 c015326b 80e25c44 00000020 0000070d de68
52e6 dd174480                                                                   
[  139.605751] Call Trace:                                                      
[  139.605751]  [<c01136c0>] ? lapic_next_event+0x20/0x30                       
[  139.605751]  [<e0a696c1>] ? acx_l_process_mgmt_frame+0x361/0x5d0 [acx]       
[  139.605751]  [<c015326b>] ? tick_dev_program_event+0x3b/0xc0                 
[  139.605751]  [<c014a7a5>] ? hrtimer_reprogram+0x85/0xc0                      
[  139.605751]  [<e0a6998e>] ? acx_l_rx_ieee802_11_frame+0x5e/0x290 [acx]       
[  139.605751]  [<c014e78b>] ? getnstimeofday+0x4b/0x100                        
[  139.605751]  [<c0136a76>] ? set_normalized_timespec+0x16/0x90                
[  139.605751]  [<e0a69bfb>] ? acx_l_process_rxbuf+0x3b/0x90 [acx]              
[  139.605751]  [<e0a6bf3b>] ? acxpci_i_interrupt+0x20b/0x320 [acx]             
[  139.605751]  [<c014e78b>] ? getnstimeofday+0x4b/0x100                        
[  139.605751]  [<c0177281>] ? handle_IRQ_event+0x41/0x80                       
[  139.605751]  [<c0178b24>] ? handle_fasteoi_irq+0x74/0xe0                     
[  139.605751]  [<c0106c15>] ? do_IRQ+0x45/0x80                                 
[  139.605751]  [<c0105003>] ? common_interrupt+0x23/0x30                       
[  139.605751]  [<c011ac25>] ? native_safe_halt+0x5/0x10                        
[  139.605751]  [<c010aaed>] ? default_idle+0x5d/0x60                           
[  139.605751]  [<c010288d>] ? cpu_idle+0x7d/0x140                              
[  139.605751]  [<c036fea3>] ? rest_init+0x53/0x60                              
[  139.605751]  =======================                                         
[  139.605751] Code: ff ff 31 d2 e9 38 ff ff ff 8d b6 00 00 00 00 8b 93 f4 1f 00
 00 b9 06 00 00 00 8b 7d e0 89 d6 83 c7 0a 83 c6 29 89 55 e4 89 7d d4 <f3> a6 74
 99 8b 43 14 c7 04 24 10 0d a7 e0 89 44 24 04 e8 63 4c                          
[  139.605751] EIP: [<e0a68864>] acx_l_process_authen+0x124/0x380 [acx] SS:ESP 0
068:c04a9dd8                                                                    
[  139.605751] Kernel panic - not syncing: Fatal exception in interrupt        

This is on 2.6.27-11 and with a Netgear (Texas Instr.)  ACX 111 (PCI ID 104c:9066) in an old P3-866 IBM NetVista box