Junglewise Threat Intelligence

CVE-2026-93115: Linux kernel mlxbf-pmc NULL pointer dereference in probe

CVE-2026-93115 · Severity: info · Published 2026-09-17

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

The Mellanox BlueField Performance Monitoring Controller (PMC) driver in the Linux kernel fails to validate that a device has an ACPI companion object before attempting to use it. An attacker with local access can force-bind the driver to a device lacking an ACPI companion, triggering a NULL pointer dereference that crashes the kernel and causes a denial of service.

Technical details

The vulnerability is a NULL pointer dereference in the mlxbf_pmc_probe() function. The driver calls acpi_device_hid() on the result of ACPI_COMPANION() without first checking if the companion object exists. A platform driver can be force-bound to devices that don't match its declared device IDs via device_match_driver_override(), allowing an attacker to trigger the missing NULL check. The fix adds a prerequisite validation that returns -ENODEV if the ACPI companion is absent, preventing the dereference. The vulnerability requires local access to override driver matching.

Affected products

  • Linux Linux kernel all versions with mlxbf-pmc driver (from introduction via commit 1a218d312e65 through fixed versions)

Timeline

  • 2026-09-17: disclosed
  • 2026-09-14: patched: Fix merged into stable kernel trees

References

Related threats