CVE-2026-72432

Received Received - Intake

TPM CRB Driver ACPI Companion NULL Pointer Dereference

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: tpm_crb: Check ACPI_COMPANION() against NULL during probe Every platform driver can be forced to match a device that doesn't match its list of device IDs because of device_match_driver_override(), so platform drivers that rely on the existence of a device's ACPI companion object need to verify its presence. Accordingly, add a requisite ACPI_COMPANION() check against NULL to the tpm_crb driver.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72432

EUVD

EUVD-2026-59331

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves the tpm_crb driver not properly checking for the presence of an ACPI companion object during device probing. Platform drivers that depend on this ACPI companion must verify its existence to avoid matching with devices that lack it, which could lead to improper driver initialization or unexpected behavior.

Detection Guidance

This vulnerability affects the Linux kernel's tpm_crb driver and requires checking for improper ACPI companion object handling. Detection involves verifying kernel logs for tpm_crb probe failures or ACPI-related errors. Use commands like 'dmesg | grep tpm_crb' or 'journalctl -k | grep -i acpi' to inspect system logs for related issues.

Impact Analysis

If exploited, this could allow an attacker to force a platform driver to match a device without a valid ACPI companion, potentially causing system instability, denial of service, or unauthorized access to trusted platform module (TPM) functionality.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. The issue is specific to the Linux kernel's tpm_crb driver and involves a missing ACPI companion check during device probe, which could lead to driver misbehavior but does not inherently impact data protection or privacy regulations.

Mitigation Strategies

Update the Linux kernel to the latest patched version where this issue is resolved. If immediate patching is not possible, consider disabling the tpm_crb driver via kernel parameters or restricting access to TPM devices until an update is applied.

Hi! I’m here to help you understand CVE-2026-72432. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70