Denial of Service in Lenovo Power Management Driver (CVE-2025-9548)

CVE-2025-9548 is a null pointer dereference vulnerability residing in the Lenovo Power Management Driver (pmdrvs.sys) affecting versions prior to 1.69.70.0. The vulnerability allows an authenticated local user with sufficient privileges to send a crafted IOCTL request to the driver interface, triggering an unhandled exception that results in a system crash (Blue Screen of Death). The researcher, Sam Dalgleish, publicly released a proof-of-concept (PoC) tool on October 10, 2026, which demonstrates the ability to invoke the crash by sending IOCTL 0x802B2243 to the device object '\.\pmdrvs'. While the vulnerability is limited to a local denial of service and does not inherently provide privilege escalation or arbitrary code execution, the availability of functional exploit code increases the risk for unpatched enterprise workstations and laptops.

Impact

Successful exploitation results in an immediate system-wide denial of service, forcing a reboot and potential data loss for any user with active sessions. The vulnerability affects a broad range of Lenovo hardware utilizing the affected Power Management Driver versions.

Recommendation

1. Patch all Lenovo systems immediately by upgrading the Power Management Driver to version 1.69.70.0 or later.
2. Audit high-availability or critical workstations for the presence of pmdrvs.sys versions earlier than 1.69.70.0.
3. Deploy detection logic to identify the execution of the identified PoC or similar attempts to interface with the vulnerable driver IOCTL interface.