CVE-2026-93115: platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL
In the Linux kernel, the following vulnerability has been resolved:
platform/mellanox: mlxbf-pmc: Check ACPICOMPANION() against NULL
Every platform driver can be forced to match a device that doesn't match its list of device IDs because of devicematchdriveroverride(), so platform drivers that rely on the existence of a device's ACPI companion object need to verify its presence.
mlxbfpmcprobe() passes the result of ACPICOMPANION() to acpidevicehid(), which dereferences it, so force-binding the driver to a device without an ACPI companion leads to a NULL pointer dereference.
Accordingly, add a requisite ACPICOMPANION() check against NULL to the mlxbf-pmc driver and return -ENODEV when the companion is missing.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In platform/mellanox/mlxbf-pmc, add a requisite ACPI_COMPANION() check against NULL before calling code paths that dereference the companion (e.g., those reaching acpi_device_hid()); if the companion is NULL, force the probe to return -ENODEV.
Linux kernel platform driver (platform/mellanox: mlxbf-pmc) ACPI_COMPANION() null check = Add check of ACPI_COMPANION() against NULL and return -ENODEV when the companion is missing (in mlxbf_pmc_probe, after ACPI_COMPANION())
Event History
Frequently Asked Questions
Under what condition can the NULL pointer dereference occur?
The mlxbf-pmc driver must be force-bound to a platform device that has no ACPI companion object. In that case, the driver passes a NULL ACPI companion to acpi_device_hid().
How does the resolved driver handle a device without an ACPI companion?
It checks whether ACPI_COMPANION() returned NULL before using it. If no companion exists, probing stops and returns -ENODEV rather than dereferencing NULL.