Executive brief
The Linux kernel's Surface platform driver can crash with a NULL pointer dereference when a device is forcibly bound to the driver without a proper ACPI companion object. This can cause system instability or denial of service on devices using Surface hardware, particularly when driver binding is manipulated outside normal operation.
Technical details
A NULL pointer dereference vulnerability exists in the surface_acpi_notify driver's san_probe() function. The vulnerability occurs because the function directly dereferences the result of ACPI_COMPANION() without checking if it is NULL. An attacker or privileged user can exploit this by forcing the driver to bind to a device lacking an ACPI companion object using device_match_driver_override(). The fix adds a NULL check on the ACPI companion and returns -ENODEV if missing, preventing the dereference. The vulnerability requires local access to trigger device binding or the ability to influence driver matching behavior.
Affected products
- Linux Linux kernel Affected versions include kernels where the ACPI_COMPANION() dereference was introduced; patched in commit 2b3a5dabe89e330413af403246b648c1890f368f
Timeline
- 2026-09-17: disclosed: CVE-2026-93114 published
- 2026-07-10: patched: Fix committed to Linux kernel stable tree