Re: [PATCH v2] usb: typec: ucsi: Add ACPI_COMPANION() NULL check in ucsi_acpi_probe

[Greg KH]

On Thu, Aug 13, 2026 at 11:25:55AM +0800, luoxueqin wrote:
> Hi Heikki,
> 
> Thanks for the review.
> 
> However, I'd like to point out that this exact issue has been recognized
> as a security vulnerability (CVE-2026-64227), and Rafael already applied
> the same fix pattern to 14 ACPI platform drivers in commit e4865a56d013
> ("ACPI: driver: Check ACPI_COMPANION() against NULL during probe"), which
> is marked for stable backport.
> 
> The NULL pointer dereference triggers a kernel oops/panic - a full system
> crash - not just a silent failure. Returning -ENODEV is the correct and
> graceful behavior, consistent with all other drivers fixed in that commit.

Yes, but it requires root to cause this crash, right?  Which probably
means that other CVE should be rejected?

As this is a manual bind command, if that ever breaks, you get to keep
the pieces.  We don't "defend" for that in the kernel.

thanks,

greg k-h