Executive brief
The Linux kernel's TPM (Trusted Platform Module) CRB driver fails to validate that an ACPI companion device exists before attempting to use it during initialization. An attacker or misconfiguration that forces a device to bind to this driver without a valid ACPI companion could trigger a null pointer dereference, causing the kernel to crash and rendering the system unavailable.
Technical details
The vulnerability is a null pointer dereference in the tpm_crb driver's crb_acpi_probe() function. The root cause is that the driver was directly assigning ACPI_COMPANION(dev) to a struct variable without checking whether the returned pointer was NULL. Although platform drivers typically match devices against their defined device IDs, the kernel's device_match_driver_override() mechanism allows forcing a device to match any driver regardless of its ID list. The fix adds an explicit NULL check immediately after calling ACPI_COMPANION(dev), returning -ENODEV if the companion object is missing. This prevents dereferencing a NULL pointer during subsequent probe operations. The attack vector requires local access to force device binding, or a misconfigured or compromised device firmware/bootloader. No remote exploitation path exists.
Affected products
- Linux Linux kernel all versions with tpm_crb driver (since conversion to platform driver)
Timeline
- 2026-08-15: disclosed
- 2026-06-21: patched