CVE-2026-89933 iio: pressure: dps310: fix NULL pointer dereference on ACPI probe
A NULL pointer dereference in the Linux kernel DPS310 pressure sensor driver causes a system crash during device probe, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89933?
CVE-2026-89933 is a vulnerability in Linux, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
iio: pressure: dps310: fix NULL pointer dereference on ACPI probe
When the device is enumerated through its ACPI HID (IFX3100), i2c_client_get_device_id() returns NULL: the ACPI-derived client name does not match the driver's i2c_device_id table. dps310_probe() then dereferences that NULL pointer in "iio->name = id->name" and crashes the kernel during probe.
The IIO device name is always "dps310", so set it directly and drop the now-unused device-id lookup.
Which versions are affected by CVE-2026-89933?
How do I fix CVE-2026-89933?
Apply the vendor's patch.
Is CVE-2026-89933 being exploited?
There is no known exploitation of CVE-2026-89933 in the wild and no public exploit code.
Sources
Also known as AZL-101129, BELL-CVE-2026-89933, DEBIAN-CVE-2026-89933, GHSA-v7h4-xc54-q6xw, UBUNTU-CVE-2026-89933.