CVE-2026-89933: Linux Kernel DPS310 Buffer Overflow Flaw

CVE-2026-89933 Overview

CVE-2026-89933 is a NULL pointer dereference in the Linux kernel's Industrial I/O (IIO) subsystem, specifically the dps310 pressure sensor driver. When the Infineon DPS310 device is enumerated through its ACPI Hardware ID (IFX3100), the ACPI-derived client name does not match the driver's i2c_device_id table. As a result, i2c_client_get_device_id() returns NULL, and dps310_probe() dereferences the NULL pointer while assigning iio->name = id->name. The kernel crashes during device probe.

Critical Impact
Systems that expose the DPS310 pressure sensor via ACPI enumeration crash during driver probe, preventing successful boot or hotplug initialization of the affected hardware.

Affected Products

Linux kernel with the iio/pressure/dps310 driver enabled
Platforms enumerating the DPS310 sensor via ACPI HID IFX3100
Stable kernel branches referenced by commits 26e9213, 3fa1895, 7ded5b7, a32a39d, and bc7b09e

Discovery Timeline

2026-09-16 - CVE-2026-89933 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89933

Vulnerability Analysis

The defect resides in the dps310_probe() function of the IIO pressure driver. The probe path calls i2c_client_get_device_id() to look up an i2c_device_id entry matching the client. When the device is bound through the ACPI subsystem using HID IFX3100, the ACPI-derived client name does not match any entry in the driver's i2c_device_id table, causing the lookup to return NULL. The subsequent statement iio->name = id->name dereferences that NULL pointer and triggers a kernel oops during probe.

The upstream fix removes the device-ID lookup entirely and assigns the IIO device name directly as the constant string dps310, which is the only valid value the driver ever used. This eliminates the dependency on a matching i2c_device_id entry when binding through ACPI.

Root Cause

The root cause is a missing NULL check after i2c_client_get_device_id() combined with an implicit assumption that i2c and ACPI enumeration paths would both populate a matching i2c_device_id. This is a classic NULL Pointer Dereference [CWE-476] in a kernel driver probe path.

Attack Vector

Triggering the crash requires the presence of DPS310 hardware exposed through ACPI with HID IFX3100, or a platform description that advertises that HID. The impact is a denial of service through a kernel crash during probe. There is no indication in the advisory of remote exploitation, memory corruption, or privilege escalation. Refer to the upstream commits for full technical context: Kernel Git Commit 26e9213, Kernel Git Commit 3fa1895, Kernel Git Commit 7ded5b7, Kernel Git Commit a32a39d, and Kernel Git Commit bc7b09e.

No verified proof-of-concept code is available. The vulnerability is described in prose based on the upstream commit message.

Detection Methods for CVE-2026-89933

Indicators of Compromise

Kernel oops or panic messages referencing dps310_probe in dmesg or the system journal.
NULL pointer dereference backtraces containing i2c_client_get_device_id immediately before the fault.
Failed probe messages for ACPI device IFX3100 on affected platforms.

Detection Strategies

Inventory Linux hosts where CONFIG_IIO and the dps310 module are enabled and correlate with hardware exposing ACPI HID IFX3100.
Parse boot logs for Unable to handle kernel NULL pointer dereference entries associated with the IIO subsystem.
Compare running kernel commit hashes against the fixed commits listed in the upstream references.

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM platform and alert on kernel oops signatures involving IIO drivers.
Track fleet-wide kernel versions and flag hosts running builds prior to the fix commits on affected stable branches.
Monitor device probe failures during boot to catch systems that fail to initialize the pressure sensor.

How to Mitigate CVE-2026-89933

Immediate Actions Required

Update affected Linux kernels to a stable release that contains one of the fix commits (26e9213, 3fa1895, 7ded5b7, a32a39d, or bc7b09e).
On systems that cannot be patched immediately, blacklist the dps310 module if the sensor is not required for platform operation.
Validate that vendor kernel builds for embedded and IoT devices ship with the corrected driver before deployment.

Patch Information

The fix is upstream in the Linux kernel. The patch sets iio->name directly to dps310 and removes the now-unused i2c_device_id lookup, eliminating the NULL dereference on the ACPI probe path. Distribution maintainers should backport the referenced commits to supported stable branches.

Workarounds

Blacklist the driver with echo "blacklist dps310" > /etc/modprobe.d/dps310.conf on systems where the sensor is optional.
Disable ACPI enumeration for the IFX3100 device in platform firmware if the sensor is not in use.
Rebuild custom kernels with CONFIG_IIO_DPS310 disabled where the pressure sensor is not required.

bash

# Prevent the vulnerable driver from loading until the patched kernel is installed
echo "blacklist dps310" | sudo tee /etc/modprobe.d/dps310.conf
sudo update-initramfs -u
sudo reboot