The Linux kernel vulnerability CVE-2026-72432 involves the tpm_crb driver not verifying the existence of a device's ACPI companion object during the probe phase. Because platform drivers can be forced to match devices that do not correspond to their device ID list via device_match_driver_override(), drivers that depend on the ACPI companion must explicitly check for its presence. The fix added a NULL check for ACPI_COMPANION() in the tpm_crb driver to prevent mismatches and potential issues arising from incorrect device matching.

This vulnerability could cause platform drivers to incorrectly bind to devices that do not match their intended device IDs, potentially leading to improper device operation or system instability. However, no specific exploitation details or impacts such as privilege escalation or code execution are provided.

A fix has been implemented in the Linux kernel by adding a NULL check for ACPI_COMPANION() in the tpm_crb driver during probe. Users should update to the fixed kernel version once available. Patch status is not explicitly confirmed in the provided data; check the vendor advisory or Linux kernel mailing lists for the exact fixed versions and update instructions.