CVE-2026-93114platform/surface: acpi-notify: Check ACPI companion before use
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: platform/surface: acpi-notify: Check ACPI companion before use Since every platform driver can be forced to match a device that doesn't match its list of device IDs because of device_match_driver_override(), platform drivers that rely on the existence of a device's ACPI companion object should verify its presence. san_probe() dereferences the result of ACPI_COMPANION() when installing the GSBUS address space handler, so force-binding the driver to a device without an ACPI companion leads to a NULL pointer dereference. The dereference was introduced when the probe function was switched from ACPI_HANDLE() to ACPI_COMPANION(). Check the ACPI companion against NULL and return -ENODEV when it is missing, like commit e4865a56d013 ("ACPI: driver: Check ACPI_COMPANION() against NULL during probe") does for the core ACPI platform drivers.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from a9e10e58730432e5de840eb3ddd55c75f29341b3 before 4faa43d4ef0b98beb6c2b77a279f4aa5d7fa2d13; from a9e10e58730432e5de840eb3ddd55c75f29341b3 before 3855be0100efb98c26228c610db70a673611f3bd; from a9e10e58730432e5de840eb3ddd55c75f29341b3 before f276b62f2ce1cbff7fa50a8ee5afd8fef5a60897; from a9e10e58730432e5de840eb3ddd55c75f29341b3 before 9b6479da662c2ec4e931ed9f7228df46aa8c3766; from a9e10e58730432e5de840eb3ddd55c75f29341b3 before 7fea5a310e3b2db24f7aafe64897e4e659ffbb7d; from a9e10e58730432e5de840eb3ddd55c75f29341b3 before 428a82d987fcd8844e8868c85582eae75b4b5c51; from a9e10e58730432e5de840eb3ddd55c75f29341b3 before 2b3a5dabe89e330413af403246b648c1890f368f | CNA record |
References
- https://git.kernel.org/stable/c/4faa43d4ef0b98beb6c2b77a279f4aa5d7fa2d13
- https://git.kernel.org/stable/c/3855be0100efb98c26228c610db70a673611f3bd
- https://git.kernel.org/stable/c/f276b62f2ce1cbff7fa50a8ee5afd8fef5a60897
- https://git.kernel.org/stable/c/9b6479da662c2ec4e931ed9f7228df46aa8c3766
- https://git.kernel.org/stable/c/7fea5a310e3b2db24f7aafe64897e4e659ffbb7d
- https://git.kernel.org/stable/c/428a82d987fcd8844e8868c85582eae75b4b5c51
- https://git.kernel.org/stable/c/2b3a5dabe89e330413af403246b648c1890f368f
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.