CVE-2026-93124: platform/x86: asus-wireless: Fail probe when there is no ACPI match
In the Linux kernel, the following vulnerability has been resolved:
platform/x86: asus-wireless: Fail probe when there is no ACPI match
Every platform driver can be forced to match a device that does not match its list of device IDs because of devicematchdriveroverride(), so platform drivers that rely on the existence of a device ACPI companion object need to verify its presence.
asuswirelessprobe() returns success when acpimatchacpidevice() finds no match, leaving behind an input device that never reports anything because the notify handler is not installed. Worse, when the driver is force-bound to a device without an ACPI companion, probe still succeeds and stores a NULL companion pointer, which asuswirelessremove() later passes to acpidevremovenotifyhandler(), leading to a NULL pointer dereference on unbind.
Return -ENODEV when the device does not match the ID table. This also covers the missing-companion case, because acpimatchacpidevice() rejects a NULL device. Perform the check before allocating any driver state, instead of after the input device has already been registered.
Event History
Frequently Asked Questions
What conditions are required to trigger the NULL pointer dereference?
The asus-wireless platform driver must be force-bound to a device that lacks an ACPI companion or does not match the driver’s ACPI ID table. If that device is later unbound, the remove path passes a NULL companion pointer to the ACPI notify-handler removal function.
Is normal hardware matching enough to expose the issue?
The problematic path occurs when the driver is forced to match a device through device_match_driver_override(). A device that does not match the ACPI ID table should not be accepted by the corrected driver.
How can I recognize an affected binding before a crash occurs?
An affected probe can succeed for a device with no ACPI match and leave behind an input device that never reports events because no notify handler was installed. Unbinding that force-bound driver can then trigger the NULL pointer dereference.