Not yet scoredPublished Sep 17, 2026

CVE-2026-93114platform/surface: acpi-notify: Check ACPI companion before use

Updated under an hour ago (Oct 27, 2026, 4:23 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: platform/surface: acpi-notify: Check ACPI companion before use Since every platform driver can be forced to match a device that doesn't match its list of device IDs because of device_match_driver_override(), platform drivers that rely on the existence of a device's ACPI companion object should verify its presence. san_probe() dereferences the result of ACPI_COMPANION() when installing the GSBUS address space handler, so force-binding the driver to a device without an ACPI companion leads to a NULL pointer dereference. The dereference was introduced when the probe function was switched from ACPI_HANDLE() to ACPI_COMPANION(). Check the ACPI companion against NULL and return -ENODEV when it is missing, like commit e4865a56d013 ("ACPI: driver: Check ACPI_COMPANION() against NULL during probe") does for the core ACPI platform drivers.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from a9e10e58730432e5de840eb3ddd55c75f29341b3 before 4faa43d4ef0b98beb6c2b77a279f4aa5d7fa2d13; from a9e10e58730432e5de840eb3ddd55c75f29341b3 before 3855be0100efb98c26228c610db70a673611f3bd; from a9e10e58730432e5de840eb3ddd55c75f29341b3 before f276b62f2ce1cbff7fa50a8ee5afd8fef5a60897; from a9e10e58730432e5de840eb3ddd55c75f29341b3 before 9b6479da662c2ec4e931ed9f7228df46aa8c3766; from a9e10e58730432e5de840eb3ddd55c75f29341b3 before 7fea5a310e3b2db24f7aafe64897e4e659ffbb7d; from a9e10e58730432e5de840eb3ddd55c75f29341b3 before 428a82d987fcd8844e8868c85582eae75b4b5c51; from a9e10e58730432e5de840eb3ddd55c75f29341b3 before 2b3a5dabe89e330413af403246b648c1890f368f	CNA record

References

References

https://git.kernel.org/stable/c/4faa43d4ef0b98beb6c2b77a279f4aa5d7fa2d13
https://git.kernel.org/stable/c/3855be0100efb98c26228c610db70a673611f3bd
https://git.kernel.org/stable/c/f276b62f2ce1cbff7fa50a8ee5afd8fef5a60897
https://git.kernel.org/stable/c/9b6479da662c2ec4e931ed9f7228df46aa8c3766
https://git.kernel.org/stable/c/7fea5a310e3b2db24f7aafe64897e4e659ffbb7d
https://git.kernel.org/stable/c/428a82d987fcd8844e8868c85582eae75b4b5c51
https://git.kernel.org/stable/c/2b3a5dabe89e330413af403246b648c1890f368f

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.