{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72432", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-09T03:40:39.929Z", "datePublished": "2026-08-15T05:56:47.478Z", "dateUpdated": "2026-08-17T05:14:32.158Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:14:32.158Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntpm_crb: Check ACPI_COMPANION() against NULL during probe\n\nEvery platform driver can be forced to match a device that doesn't match\nits list of device IDs because of device_match_driver_override(), so\nplatform drivers that rely on the existence of a device's ACPI companion\nobject need to verify its presence.\n\nAccordingly, add a requisite ACPI_COMPANION() check against NULL to the\ntpm_crb driver."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/char/tpm/tpm_crb.c"], "versions": [{"version": "48fe2cddc85c7849463bd01ae8b8c6b575ff508b", "lessThan": "c041d2be785feb9b5e36331921eadaefbe65349d", "status": "affected", "versionType": "git"}, {"version": "48fe2cddc85c7849463bd01ae8b8c6b575ff508b", "lessThan": "ddd33806b8911fa2ef849e8bbbab1e3fcb26adc0", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/char/tpm/tpm_crb.c"], "versions": [{"version": "7.1", "status": "affected"}, {"version": "0", "lessThan": "7.1", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/c041d2be785feb9b5e36331921eadaefbe65349d"}, {"url": "https://git.kernel.org/stable/c/ddd33806b8911fa2ef849e8bbbab1e3fcb26adc0"}], "title": "tpm_crb: Check ACPI_COMPANION() against NULL during probe", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/char/tpm/tpm_crb.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "c041d2be785feb9b5e36331921eadaefbe65349d", "status": "affected", "version": "48fe2cddc85c7849463bd01ae8b8c6b575ff508b", "versionType": "git"}, {"lessThan": "ddd33806b8911fa2ef849e8bbbab1e3fcb26adc0", "status": "affected", "version": "48fe2cddc85c7849463bd01ae8b8c6b575ff508b", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/char/tpm/tpm_crb.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.1"}, {"lessThan": "7.1", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntpm_crb: Check ACPI_COMPANION() against NULL during probe\n\nEvery platform driver can be forced to match a device that doesn't match\nits list of device IDs because of device_match_driver_override(), so\nplatform drivers that rely on the existence of a device's ACPI companion\nobject need to verify its presence.\n\nAccordingly, add a requisite ACPI_COMPANION() check against NULL to the\ntpm_crb driver."}], "id": "CVE-2026-72432", "lastModified": "2026-08-17T06:19:10.530", "metrics": {}, "published": "2026-08-15T06:22:17.057", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c041d2be785feb9b5e36331921eadaefbe65349d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ddd33806b8911fa2ef849e8bbbab1e3fcb26adc0"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: tpm_crb: Check ACPI_COMPANION() against NULL during probe", "id": "2516729", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516729"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ntpm_crb: Check ACPI_COMPANION() against NULL during probe\nEvery platform driver can be forced to match a device that doesn't match\nits list of device IDs because of device_match_driver_override(), so\nplatform drivers that rely on the existence of a device's ACPI companion\nobject need to verify its presence.\nAccordingly, add a requisite ACPI_COMPANION() check against NULL to the\ntpm_crb driver.", "A flaw was found in the Linux kernel's Trusted Platform Module (TPM) Command Response Buffer (CRB) driver. This vulnerability occurs because the driver does not properly check for the presence of an Advanced Configuration and Power Interface (ACPI) companion object during device probing. An attacker could potentially exploit this by forcing the driver to match a device without an ACPI companion, which may lead to a system crash or denial of service."], "name": "CVE-2026-72432", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-72432\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-72432\nhttps://lore.kernel.org/linux-cve-announce/2026081527-CVE-2026-72432-14bb@gregkh/T"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[48fe2cddc85c7849463bd01ae8b8c6b575ff508b,c041d2be785feb9b5e36331921eadaefbe65349d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[48fe2cddc85c7849463bd01ae8b8c6b575ff508b,ddd33806b8911fa2ef849e8bbbab1e3fcb26adc0)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.1"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,7.1)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T18:00:11.226357+00:00", "updated": "2026-08-22T03:30:16.804166+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-476"]}