Skip to main content
VulnerabilityPublished Updated

CVE-2026-89933: Linux kernel · iio: pressure: dps310: fix NULL pointer dereference on ACPI probe

Affects Linux kernelSource CVE Database V5

0
Compare

Not known to be exploited · fixed in bc7b09e701b4175fc683b579fcdef3bfac809239 : update Linux kernel when convenient.

Data as of 30 Oct 2026, 13:03 UTC

Severity
Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

Thin evidence

One scorer or none
Patch
Available – fixed in bc7b09e701b4175fc683b579fcdef3bfac809239, a32a39da18e01b20c2ab65af9be34dc870187382, 37e59123a5f1dc9030825685074819f8318153b9 +3

Exploitation evidence

  1. Disclosed: evidence found.

    CVE published 16 Sep 2026

  2. Detectable: no evidence on record.

    No public nuclei template indexed

  3. Weaponized: no evidence on record.

    No public exploit code indexed in Metasploit or Exploit-DB

  4. Exploited in the wild: no evidence on record.

    Not in CISA KEV and no source reports exploitation

  5. Observed by OffSeq Mirage: no evidence on record.

    No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

ProductAffectedFixed in
LinuxLinuxAffected
  • ≥ 72ff282819d0526d3e4417c2a61414557981b5af, < bc7b09e701b4175fc683b579fcdef3bfac809239
Fixed in
  • bc7b09e701b4175fc683b579fcdef3bfac809239
LinuxLinuxAffected
  • ≥ 72ff282819d0526d3e4417c2a61414557981b5af, < a32a39da18e01b20c2ab65af9be34dc870187382
Fixed in
  • a32a39da18e01b20c2ab65af9be34dc870187382
LinuxLinuxAffected
  • ≥ 72ff282819d0526d3e4417c2a61414557981b5af, < 37e59123a5f1dc9030825685074819f8318153b9
Fixed in
  • 37e59123a5f1dc9030825685074819f8318153b9
LinuxLinuxAffected
  • ≥ 72ff282819d0526d3e4417c2a61414557981b5af, < 26e9213898fc949923188ef0aeea31fc87708836
Fixed in
  • 26e9213898fc949923188ef0aeea31fc87708836
LinuxLinuxAffected
  • ≥ 72ff282819d0526d3e4417c2a61414557981b5af, < 7ded5b76ec2df6a3fb1bfde0d1869cde363fef30
Fixed in
  • 7ded5b76ec2df6a3fb1bfde0d1869cde363fef30
LinuxLinuxAffected
  • ≥ 72ff282819d0526d3e4417c2a61414557981b5af, < 3fa189573cca284ae663bfd2d5b9ed755bec5e9d
Fixed in
  • 3fa189573cca284ae663bfd2d5b9ed755bec5e9d

AI-suggested

A patch is available and has been applied in the Linux kernel source as indicated by multiple fixed commit versions. Users and administrators should update to a fixed kernel version that includes these commits to remediate the issue. Since this is a kernel-level issue, updating the kernel is the recommended and effective mitigation.

Description

A NULL pointer dereference vulnerability in the Linux kernel's iio pressure sensor driver (dps310) was fixed. The issue occurs during ACPI probe when the device is enumerated via its ACPI HID (IFX3100). The function i2c_client_get_device_id() returns NULL because the ACPI-derived client name does not match the driver's i2c_device_id table, leading to a kernel crash when the driver dereferences the NULL pointer. The fix sets the device name directly, avoiding the NULL pointer dereference.

References

Community reviews

Loading reviews…