CVE-2026-93124None▾ Sunlit

In the Linux kernel, the following vulnerability has been resolved: platform/x86: asus-wireless: Fail probe when there is no ACPI match Every platform driver can be forced to match a device that does not match its list of device IDs be…

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score3/ 100 · Minimal

impact 2.8 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Sep 17, 2026

Updated

Sep 17, 2026

CVSS

—

Vendor

Linux

Product

Linux

CWE

—

Depth score

3 · Minimal

EPSS

0.20% · p9

Platforms

—

Source

NVD

Vector

—

EPSS history

Exploit-prediction probability, daily snapshots since Sep 19.

0.2% → 0.2%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 8 days

Sep 17, 2026Published
Disclosed via NVD
Sep 19, 2026EPSS first tracked
0.2%
Sep 25, 2026EPSS peak
0.2% → 0.2%

Linux #nvd #cve.org

Affected

Linux >= f7e648027d7e1b5c06eb86d944b7e23926254cee < 7bfa711f311a584002e16ecd750627306deb805c
Linux >= f7e648027d7e1b5c06eb86d944b7e23926254cee < 4aefd66ef7822cf7d3f53146dcee0b71021ed2b7
Linux 7.1

Full technical detail▾

Overview

In the Linux kernel, the following vulnerability has been resolved:

platform/x86: asus-wireless: Fail probe when there is no ACPI match

Every platform driver can be forced to match a device that does not match its list of device IDs because of device_match_driver_override(), so platform drivers that rely on the existence of a device ACPI companion object need to verify its presence.

asus_wireless_probe() returns success when acpi_match_acpi_device() finds no match, leaving behind an input device that never reports anything because the notify handler is not installed. Worse, when the driver is force-bound to a device without an ACPI companion, probe still succeeds and stores a NULL companion pointer, which asus_wireless_remove() later passes to acpi_dev_remove_notify_handler(), leading to a NULL pointer dereference on unbind.

Return -ENODEV when the device does not match the ID table. This also covers the missing-companion case, because acpi_match_acpi_device() rejects a NULL device. Perform the check before allocating any driver state, instead of after the input device has already been registered.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#cve.org