--- cve: "CVE-2026-93114" severity: "LOW" cvss: 3.1 epss: "5.6%" vendor: "Linux" kev: false exploited: false published: "2026-09-17 17:18:05" tags: [cve, security, low] source: tsecurity.de CVE-Dossier exported: "2026-09-21T21:59:13+02:00" --- # CVE-2026-93114 > 3.1 LOW ## Beschreibung In the Linux kernel, the following vulnerability has been resolved: platform/surface: acpi-notify: Check ACPI companion before use Since every platform driver can be forced to match a device that doesn't match its list of device IDs because of device_match_driver_override(), platform drivers that rely on the existence of a device's ACPI companion object should verify its presence. san_probe() dereferences the result of ACPI_COMPANION() when installing the GSBUS address space handler, so force-binding the driver to a device without an ACPI companion leads to a NULL pointer dereference. The dereference was introduced when the probe function was switched from ACPI_HANDLE() to ACPI_COMPANION(). Check the ACPI companion against NULL and return -ENODEV when it is missing, like commit e4865a56d013 ("ACPI: driver: Check ACPI_COMPANION() against NULL during probe") does for the core ACPI platform drivers. ## Patch verfügbar (OSV) - Kernel ≥ 5.15.221 - Kernel ≥ 6.1.188 - Kernel ≥ 6.6.157 - Kernel ≥ 6.12.110 - Kernel ≥ 6.18.52 - Kernel ≥ 7.2.6 ## Referenzen - - - - - - - --- _Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-93114) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_