CVE-2026-64227: Linux Kernel Privilege Escalation Flaw

CVE-2026-64227 Overview

CVE-2026-64227 is a Linux kernel vulnerability in the Advanced Configuration and Power Interface (ACPI) subsystem. Platform drivers that depend on a device's ACPI companion object failed to verify its presence during probe. Because device_match_driver_override() allows any platform driver to bind to a device outside its declared device ID list, a mismatched device without an ACPI companion could trigger a NULL pointer dereference [CWE-476]. The fix adds ACPI_COMPANION() and ACPI_HANDLE() NULL checks to 13 platform drivers handling core ACPI devices. The ACPI thermal zone driver was also updated to return -ENODEV for consistency when the companion is absent.

Critical Impact
A local user leveraging driver_override can bind an unrelated device to an ACPI platform driver, causing a kernel NULL pointer dereference and denial of service.

Affected Products

Linux kernel (upstream stable branches receiving the referenced commits)
Distributions shipping affected ACPI platform drivers prior to the fix
Systems using core ACPI-dependent platform drivers (thermal zone and related)

Discovery Timeline

2026-07-24 - CVE-2026-64227 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64227

Vulnerability Analysis

The Linux kernel platform driver framework allows administrators to force a driver-to-device binding through the driver_override sysfs attribute. This bypasses the driver's declared acpi_match_table and of_match_table. When a platform driver assumes an ACPI companion object exists and calls ACPI_COMPANION() or ACPI_HANDLE() without a NULL check, the driver dereferences a NULL pointer during probe. The result is a kernel oops and denial of service on the affected system.

The patch series addresses 13 platform drivers that manage core ACPI devices. Each affected probe path now validates that ACPI_COMPANION(dev) returns a non-NULL pointer before proceeding. The ACPI thermal zone driver additionally normalizes its error return to -ENODEV, aligning with other ACPI-aware drivers when no companion is available.

Root Cause

The root cause is a missing precondition check. Platform drivers registered with the ACPI bus historically assumed the presence of a valid ACPI companion object during probe. The device_match_driver_override() mechanism removes that guarantee by permitting arbitrary device-driver pairings, so any assumption about companion presence becomes exploitable through user-controlled binding.

Attack Vector

Exploitation requires local root capability to write to /sys/bus/platform/devices/<device>/driver_override and trigger a rebind. Once the mismatched binding is forced, the affected driver's probe function executes against a device with no ACPI companion, dereferences a NULL pointer, and panics or oopses the kernel. The impact is denial of service against the running kernel.

No exploit code is required beyond standard sysfs writes. The vulnerability is not remotely reachable and depends on privileged local access. Detailed patch content is available in the referenced kernel commits.

Detection Methods for CVE-2026-64227

Indicators of Compromise

Kernel oops or panic messages referencing NULL pointer dereference within ACPI platform driver probe functions such as the ACPI thermal zone driver.
Unexpected writes to /sys/bus/platform/devices/*/driver_override followed by unbind and bind operations.
System crashes or reboots correlating with driver rebind activity in kernel logs.

Detection Strategies

Monitor dmesg and journalctl -k for probe-time NULL dereference stack traces mentioning ACPI_COMPANION or affected driver names.
Audit sysfs writes to driver_override attributes using Linux Audit rules on /sys/bus/platform/devices/.
Track process activity that opens sysfs bind and unbind files under /sys/bus/platform/drivers/.

Monitoring Recommendations

Ingest kernel logs into a centralized logging platform and alert on repeated ACPI driver oops signatures.
Baseline expected driver binding activity and flag anomalous rebind operations from non-administrative processes.
Correlate crash telemetry with the affected kernel versions listed in the referenced kernel commits.

How to Mitigate CVE-2026-64227

Immediate Actions Required

Update to a Linux kernel build that includes the commits 34f4d0e, 612ddab, a9451bf, and e4865a5.
Restrict write access to /sys/bus/platform/devices/*/driver_override to trusted administrative accounts only.
Review distribution security bulletins for backported patches to long-term support kernel branches.

Patch Information

The upstream fix is distributed across four commits: Kernel Git Commit 34f4d0e, Kernel Git Commit 612ddab, Kernel Git Commit a9451bf, and Kernel Git Commit e4865a5. These commits add ACPI_COMPANION() and ACPI_HANDLE() NULL checks across 13 platform drivers and standardize the thermal zone driver's error return to -ENODEV.

Workarounds

Limit local privileged access so untrusted users cannot invoke driver_override operations.
Where feasible, mount sysfs with tighter access controls and enforce mandatory access control policies (SELinux, AppArmor) to block writes to platform driver_override files.
Disable or unload unused ACPI platform drivers on systems that do not require them until patched kernels are deployed.

bash

# Configuration example: audit rule to log driver_override writes
auditctl -w /sys/bus/platform/devices/ -p wa -k platform_driver_override