CVE-2026-89933 Linux CVE debrief

Who should care

Linux system administrators and maintainers, particularly those using ACPI-enumerated devices, should assess exposure and apply patches or updates to vulnerable systems. Additionally, Linux system administrators and maintainers should review system configurations, check for ACPI-enumerated devices using the dps310 driver, and monitor system logs for potential crashes or errors related to the driver. Linux system administrators and maintainers should also

Why it matters

This vulnerability can cause kernel crashes or errors on Linux systems using ACPI-enumerated devices with the dps310 driver. Linux system administrators and maintainers should assess exposure and apply patches or updates to vulnerable systems.

• Potential kernel crashes or errors related to the dps310 driver
• Need to verify and apply patches or updates to vulnerable systems
• Possible impact on system stability or reliability

Technical summary

The Linux kernel's iio: pressure: dps310 driver is vulnerable to a NULL pointer dereference during ACPI probe. This occurs when i2c_client_get_device_id() returns NULL for devices enumerated through their ACPI HID (IFX3100). The IIO device name is always 'dps310', which can be set directly to avoid the NULL pointer dereference. To address this vulnerability, Linux system administrators and maintainers should assess exposure and apply patches or updates to vulnerable systems. The vulnerability can cause kernel crashes or errors on Linux systems using ACPI-enumerated devices with the dps310 driver

Defensive priority

Apply patches or updates from the Linux vendor to vulnerable systems, particularly those using ACPI-enumerated devices.

Recommended defensive actions

• Apply patches or updates from the Linux vendor to vulnerable systems
• Inventory Linux systems using ACPI-enumerated devices for potential exposure
• Monitor system logs for potential crashes or errors related to the dps310 driver
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its cause and potential impact. However, specific exploitation details or victim information are not provided. To verify and assess exposure, defenders should review system configurations, check for ACPI-enumerated devices using the dps310 driver, and monitor system logs for potential crashes or errors related to the driver. Additionally, defenders should ensure that patches or updates from the Linux vendor are applied to vulnerable systems, particularly

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.