CVE-2026-68378: dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync()
In the Linux kernel, the following vulnerability has been resolved:
dpll: fix NULL pointer dereference in dpllmsgaddpinrefsync()
When a dpllpin is shared across multiple dplldevice instances and those devices are being unregistered (e.g. during driver module removal), a NULL pointer dereference can occur in dpllmsgaddpinrefsync().
This happens under the following conditions: - A pin is registered with two or more dpll devices (dpllA, dpllB) - The pin has refsync pairs with other pins - During unregistration of dpllA's pins, a refsync partner pin is unregistered first, removing it from dpllA->pinrefs - But since the partner pin is still registered with dpllB, its dpllrefs is not empty, so dpllpinrefsyncpairdel() does NOT run and the partner stays in the pin's refsyncpins xarray - When the pin itself is then unregistered from dpllA, the delete notification calls dpllmsgaddpinrefsync() which finds the partner in refsyncpins, passes dpllpinavailable() (partner is still registered with dpllB), but dpllpinondpllpriv(dpllA, partner) returns NULL because partner was already removed from dpllA->pinrefs - The NULL priv pointer is passed to the driver's refsyncget callback, which dereferences it
BUG: kernel NULL pointer dereference, address: 0000000000000034 Oops: Oops: 0000 [#1] SMP NOPTI RIP: 0010:zl3073xdpllinputpinrefsyncget+0x73/0x80 [zl3073x] Call Trace: dpllmsgaddpinrefsync+0xb8/0x200 dpllcmdpingetone+0x3b6/0x4b0 dpllpineventsend+0x72/0x140 dpllpinunregister+0x5a/0x2b0 dpllpinunregister+0x49/0x70
Fix this by skipping refsync pins whose priv pointer cannot be resolved for the current dpll device.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify dpll_msg_add_pin_ref_sync() to skip ref_sync pins where the NULL priv pointer cannot be resolved (i.e., avoid dereferencing the NULL priv pointer passed to ref_sync_get), addressing the NULL pointer dereference in dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync().
Linux kernel dpll ref_sync handling in dpll_msg_add_pin_ref_sync() = Skip ref_sync pins whose priv pointer cannot be resolved
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68378?
CVE-2026-68378 has a risk rating of 27.
How do I fix CVE-2026-68378?
To address CVE-2026-68378, update your Linux kernel to the latest version that includes the fix for the NULL pointer dereference.
What causes the CVE-2026-68378 vulnerability?
CVE-2026-68378 is caused by a NULL pointer dereference in the dpll_msg_add_pin_ref_sync() function when shared dpll_pin instances are unregistered.
What impact does CVE-2026-68378 have on Linux systems?
CVE-2026-68378 can lead to a crash of the system or affected applications due to the NULL pointer dereference.
Is CVE-2026-68378 specific to a certain version of the Linux kernel?
CVE-2026-68378 affects multiple versions of the Linux kernel that utilize the dpll subsystem.