Cloudanix VulnDB

CVE-2026-93115

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in a Linux driver for certain hardware could let a local attacker crash the whole system by tricking the driver into running on the wrong device.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

NULL pointer dereference in mlxbf_pmc_probe when ACPI_COMPANION returns NULL, caused by passing the result directly to acpi_device_hid without a guard, triggered via device_match_driver_override forcing an incompatible device binding.

Why it matters to the business

Kernel crash or denial of service on systems using the mlxbf-pmc driver if an attacker or misconfiguration forces driver binding to a device lacking an ACPI companion object.

How an attack unfolds

An attacker with local access or the ability to influence device matching uses device_match_driver_override to bind the mlxbf-pmc driver to a device without an ACPI companion; during probe the missing check allows acpi_device_hid to dereference NULL, crashing the kernel.

How to fix it

Update the Linux kernel to a version containing the ACPI_COMPANION NULL check in mlxbf-pmc; rebuild and deploy the patched kernel module or full kernel image.

How to confirm the fix worked

Inspect mlxbf_pmc_probe source for an explicit ACPI_COMPANION(dev) != NULL test before calling acpi_device_hid; confirm the driver returns -ENODEV on missing companion.

Typical attack path

  1. Obtain local access or ability to load platform drivers
  2. Identify or create a device without ACPI companion
  3. Force driver binding via sysfs or module parameters
  4. Trigger device probe to reach mlxbf_pmc_probe
  5. Cause NULL dereference leading to kernel panic

How to detect it

Search kernel logs and dmesg for oops or panic traces referencing mlxbf_pmc_probe, ACPI_COMPANION, or acpi_device_hid; review audit logs for unexpected driver binding events.

  • mlxbf_pmc_probe
  • acpi_device_hid
  • ACPI_COMPANION

What your security team should do

  • Apply the upstream kernel patch adding the NULL guard immediately
  • Audit systems for custom driver overrides or force-binding configurations
  • Monitor kernel logs for oops involving mlxbf_pmc or acpi_device_hid
  • Restrict unprivileged module loading and device matching where possible

The record

In the Linux kernel, the following vulnerability has been resolved: platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL Every platform driver can be forced to match a device that doesn't match its list of device IDs because of device_match_driver_override(), so platform drivers that rely on the existence of a device's ACPI companion object need to verify its presence. mlxbf_pmc_probe() passes the result of ACPI_COMPANION() to acpi_device_hid(), which dereferences it, so force-binding the driver to a device without an ACPI companion leads to a NULL pointer dereference. Accordingly, add a requisite ACPI_COMPANION() check against NULL to the mlxbf-pmc driver and return -ENODEV when the companion is missing.

Affected packages

Ecosystem Package Introduced Fixed