Executive brief
The Linux kernel's DPS310 pressure sensor driver crashes during device initialization when enumerated through ACPI. The device fails to load on affected systems, causing service unavailability for applications that depend on pressure sensor data.
Technical details
A NULL pointer dereference occurs in the dps310_probe() function when the device is enumerated via ACPI HID (IFX3100). The driver attempts to retrieve the device ID using i2c_client_get_device_id(), which returns NULL because the ACPI-derived client name does not match the i2c_device_id table. The probe function then dereferences this NULL pointer when assigning iio->name = id->name, causing a kernel crash. The fix replaces the device-id lookup with a direct assignment of the constant device name "dps310", eliminating the NULL dereference. The vulnerability was introduced when ACPI HID support was added to the driver.
Affected products
- Linux Linux kernel 5.x through current
Timeline
- 2026-09-16: disclosed: CVE-2026-89933 published
- 2026-08-07: patched: Fix committed to upstream kernel
- 2026-09-11: patched: Fix backported to stable kernel trees