Executive brief
The Mellanox BlueField Performance Monitoring Controller (PMC) driver in the Linux kernel fails to validate that a device has an ACPI companion object before attempting to use it. An attacker with local access can force-bind the driver to a device lacking an ACPI companion, triggering a NULL pointer dereference that crashes the kernel and causes a denial of service.
Technical details
The vulnerability is a NULL pointer dereference in the mlxbf_pmc_probe() function. The driver calls acpi_device_hid() on the result of ACPI_COMPANION() without first checking if the companion object exists. A platform driver can be force-bound to devices that don't match its declared device IDs via device_match_driver_override(), allowing an attacker to trigger the missing NULL check. The fix adds a prerequisite validation that returns -ENODEV if the ACPI companion is absent, preventing the dereference. The vulnerability requires local access to override driver matching.
Affected products
- Linux Linux kernel all versions with mlxbf-pmc driver (from introduction via commit 1a218d312e65 through fixed versions)
Timeline
- 2026-09-17: disclosed
- 2026-09-14: patched: Fix merged into stable kernel trees