CVE-2026-93114: Linux kernel · platform/surface: acpi-notify: Check ACPI companion before use
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in f276b62f2ce1cbff7fa50a8ee5afd8fef5a60897 : update Linux kernel when convenient.
Data as of 26 Oct 2026, 14:46 UTC
Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 6% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in f276b62f2ce1cbff7fa50a8ee5afd8fef5a60897, 3855be0100efb98c26228c610db70a673611f3bd, 428a82d987fcd8844e8868c85582eae75b4b5c51 +4
Exploitation evidence
Disclosed: evidence found.
CVE published 17 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade to a fixed release listed under Affected software.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
AI-suggested
A fix is available and has been applied in Linux kernel version 5.14 and subsequent commits identified by the fixedVersions hashes. Users should update to a patched kernel version that includes these fixes. No additional mitigation is required beyond applying the official patch.
Description
A vulnerability in the Linux kernel platform/surface ACPI notify driver could cause a NULL pointer dereference due to missing checks for the ACPI companion object. This occurs when a platform driver is forced to bind to a device lacking an ACPI companion, leading to a crash during the installation of the GSBUS address space handler. The issue was fixed by adding a check for the ACPI companion against NULL and returning an error if it is missing.
References
- git.kernel.org/stable/c/4faa43d4ef0b98beb6c2b77a279f4aa5d7fa2d13 (opens in a new tab)
- git.kernel.org/stable/c/3855be0100efb98c26228c610db70a673611f3bd (opens in a new tab)
- git.kernel.org/stable/c/f276b62f2ce1cbff7fa50a8ee5afd8fef5a60897 (opens in a new tab)
- git.kernel.org/stable/c/9b6479da662c2ec4e931ed9f7228df46aa8c3766 (opens in a new tab)
- git.kernel.org/stable/c/7fea5a310e3b2db24f7aafe64897e4e659ffbb7d (opens in a new tab)
- git.kernel.org/stable/c/428a82d987fcd8844e8868c85582eae75b4b5c51 (opens in a new tab)
- git.kernel.org/stable/c/2b3a5dabe89e330413af403246b648c1890f368f (opens in a new tab)