CVE-2026-72346

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

platform/x86: bitland-mifs-wmi: Fix NULL pointer dereference during suspend/resume

The driver registers two distinct WMI devices: a control device

(BITLAND_WMI_CONTROL) and an event device (BITLAND_WMI_EVENT). During

the probe phase, the event device handling path returns early before

initializing the platform profile device (data->pp_dev), leaving it

NULL.

However, the PM sleep operations are registered globally for the WMI

driver and are triggered for both devices. When entering suspend, the

event device invokes bitland_mifs_wmi_suspend(), which passes the

uninitialized data->pp_dev (NULL) into laptop_profile_get(). This leads

to a NULL pointer dereference inside dev_get_drvdata(), causing a

kernel Oops and halting the suspend sequence.

Fix this by adding a validity check for data->pp_dev in both the suspend

and resume callbacks, safely skipping profile operations for the event

device.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References