Executive brief
A vulnerability was identified in the Linux kernel's ACPI driver subsystem where certain platform drivers failed to verify the existence of a device's ACPI companion object during initialization. This could lead to system instability or crashes if a driver is forced to match with a device that lacks the expected ACPI data. The issue has been resolved by adding mandatory checks to 13 core ACPI drivers to ensure they handle missing companion objects gracefully.
Technical details
A vulnerability in the Linux kernel ACPI subsystem stems from a lack of NULL pointer validation during the driver probe phase. Specifically, 13 platform drivers (including AC, battery, button, and thermal drivers) relied on the existence of an ACPI companion object without verifying its presence. Because 'device_match_driver_override()' can force a driver to match a device outside its standard ID list, these drivers could attempt to dereference a NULL ACPI companion pointer. The fix introduces explicit checks for ACPI_COMPANION() and ACPI_HANDLE() against NULL in the affected drivers' probe functions, returning -ENODEV if the companion is missing.
Affected products
- Linux Linux Kernel 6.6.145, 6.12.97, 6.18.40, 7.0.11
Timeline
- 2026-07-24: advisory
- 2026-07-24: patched
References
- https://git.kernel.org/stable/c/34f4d0e4e5065237d15651df759a99e81b7f9f51
- https://git.kernel.org/stable/c/612ddab8fce04394bd7aebe8e0f2599642e30859
- https://git.kernel.org/stable/c/a9451bf561232314755baf69a5916e0ac77f33fc
- https://git.kernel.org/stable/c/e4865a56d013e86e46ea6acea15bb6eae01898ff
- https://git.kernel.org/stable/c/f1e12d81f9cd250e722da01c7670b518d4181406