CVE-2026-72432 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux systems with tpm_crb enabled should be aware of this vulnerability. They should verify Linux kernel updates for tpm_crb and assess device ACPI companion object presence to prevent potential issues. This includes reviewing the Linux kernel's tpm_crb driver and ensuring that the ACPI_COMPANION() check is implemented correctly. Additionally, Linux system administrators should inventory Linux systems for tpm_crb usage and prioritize updates accordingly. Security teams should also review compensating controls for exposed systems while remediation is scheduled and verified. Monitoring and detection capabilities should be checked for exposed assets that need extra review. Exceptions should be tracked, and remediated assets should be retested and closed only after evidence is documented. This requires coordination between Linux kernel developers, Linux distribution vendors, and Linux system administrators to ensure that the vulnerability is properly addressed. Furthermore, Linux kernel developers should consider the impact on other kernel components and ensure that the fix does not introduce new vulnerabilities. Linux distribution vendors should also consider the impact on their downstream products and ensure that the fix is properly integrated. Linux system administrators should prioritize updates based on their specific use cases and ensure that the fix is properly tested and validated. Overall, a coordinated effort is required to address this vulnerability and prevent potential issues. Linux kernel developers, Linux distribution vendors, and Linux system administrators must work together to ensure that the fix is properly implemented and that the vulnerability is fully addressed. This includes reviewing and updating documentation, testing and validating the fix, and ensuring that the fix is properly deployed across all affected systems. By working together, Linux kernel developers, Linux distribution vendors, and Linux system administrators can ensure that the CVE-2026-72432 vulnerability is properly addressed and that the Linux kernel is secure and reliable. The Linux kernel's t

Technical summary

The CVE-2026-72432 vulnerability is related to the tpm_crb driver in the Linux kernel. It requires a check for ACPI_COMPANION() against NULL during the probe to ensure that the device's ACPI companion object is present. This prevents potential issues with platform drivers being forced to match devices that do not match their device IDs. The Linux kernel's tpm_crb driver needs to be updated to include this check.

Defensive priority

Verify Linux kernel updates for tpm_crb and assess device ACPI companion object presence.

Recommended defensive actions

• Verify Linux kernel updates for tpm_crb
• Assess device ACPI companion object presence
• Inventory Linux systems for tpm_crb usage
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE-2026-72432 vulnerability involves a check against NULL for ACPI_COMPANION() during the probe of tpm_crb in the Linux kernel. This is to prevent forced matching of platform drivers with devices that do not match their device IDs. The requisite check ensures the presence of a device's ACPI companion object. Linux kernel developers should verify the updates for tpm_crb and assess device ACPI companion object presence. Evidence is limited to supplied source corpus and CVE record details.

Official resources