CVE-2026-93114: platform/surface: acpi-notify: Check ACPI companion before use
In the Linux kernel, the following vulnerability has been resolved:
platform/surface: acpi-notify: Check ACPI companion before use
Since every platform driver can be forced to match a device that doesn't match its list of device IDs because of devicematchdriveroverride(), platform drivers that rely on the existence of a device's ACPI companion object should verify its presence.
sanprobe() dereferences the result of ACPICOMPANION() when installing the GSBUS address space handler, so force-binding the driver to a device without an ACPI companion leads to a NULL pointer dereference. The dereference was introduced when the probe function was switched from ACPIHANDLE() to ACPICOMPANION().
Check the ACPI companion against NULL and return -ENODEV when it is missing, like commit e4865a56d013 ("ACPI: driver: Check ACPICOMPANION() against NULL during probe") does for the core ACPI platform drivers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the ACPI companion usage in the relevant platform drivers (including acpi-notify/san_probe) to check the result of ACPI_COMPANION() for NULL before dereferencing it; if it is NULL, return -ENODEV.
Linux kernel (ACPI core / platform drivers) ACPI_COMPANION() handling = Check ACPI companion for NULL and return -ENODEV
Event History
Frequently Asked Questions
What condition is required to trigger the NULL pointer dereference?
An attacker or local administrator must force-bind the affected platform driver to a device that has no ACPI companion object, using device_match_driver_override(). The driver then dereferences the missing ACPI companion while installing the GSBUS address space handler.
Are normally matched devices affected?
The described crash condition depends on force-binding the driver to a device outside its intended device-ID matching path and without an ACPI companion. The provided information does not indicate that ordinarily matched devices trigger the issue.
What happens after the fix when the driver is bound to a device without an ACPI companion?
The driver checks whether ACPI_COMPANION() is NULL during probe. If it is missing, probing fails with -ENODEV instead of dereferencing a NULL pointer.