UBUNTU-CVE-2026-68378: Null Pointer Dereference
In the Linux kernel, the following vulnerability has been resolved: dpll: fix NULL pointer dereference in dpllmsgaddpinrefsync() When a dpllpin is shared across multiple dplldevice instances and those devices are being unregistered (e.g. during driver module removal), a NULL pointer dereference can occur in dpllmsgaddpinrefsync(). This happens under the following conditions: - A pin is registered with two or more dpll devices (dpllA, dpllB) - The pin has refsync pairs with other pins - During unregistration of dpllA's pins, a refsync partner pin is unregistered first, removing it from dpllA->pinrefs - But since the partner pin is still registered with dpllB, its dpllrefs is not empty, so dpllpinrefsyncpairdel() does NOT run and the partner stays in the pin's refsyncpins xarray - When the pin itself is then unregistered from dpllA, the delete notification calls dpllmsgaddpinrefsync() which finds the partner in refsyncpins, passes dpllpinavailable() (partner is still registered with dpllB), but dpllpinondpllpriv(dpllA, partner) returns NULL because partner was already removed from dpllA->pinrefs - The NULL priv pointer is passed to the driver's refsyncget callback, which dereferences it BUG: kernel NULL pointer dereference, address: 0000000000000034 Oops: Oops: 0000 [#1] SMP NOPTI RIP: 0010:zl3073xdpllinputpinrefsyncget+0x73/0x80 [zl3073x] Call Trace: dpllmsgaddpinrefsync+0xb8/0x200 dpllcmdpingetone+0x3b6/0x4b0 dpllpineventsend+0x72/0x140 dpllpinunregister+0x5a/0x2b0 dpllpinunregister+0x49/0x70 Fix this by skipping refsync pins whose priv pointer cannot be resolved for the current dpll device.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.16~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38~24.04.4 - Upgrade
Upgrade
ubuntu/linux-nvidia-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1024.25~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-38.38 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1008.9 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-nvidia-bosto a version that resolves this vulnerability.Fixed in 7.0.0-2022.23 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Upgrade
Upgrade
linux kernelto a version that resolves this vulnerability.Patch dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync()
Event History
Frequently Asked Questions
What systems are realistically exposed to this issue?
Exposure requires a Linux kernel setup using DPLL devices where a single dpll_pin is shared by two or more dpll_device instances and has ref_sync relationships with other pins. The issue is triggered during device or driver unregistration, such as driver module removal.
What sequence is needed to trigger the NULL pointer dereference?
A ref_sync partner pin must be removed from one DPLL device before the shared pin, while that partner remains registered with another DPLL device. When the shared pin is then removed from the first device, the kernel can retain a stale ref_sync entry and pass a NULL private pointer to the notification path.
Is a default Ubuntu installation affected?
The provided information does not establish that a default installation configures or uses the required shared DPLL pin and ref_sync topology. The affected Ubuntu kernel package variants listed are linux-riscv, linux-realtime, linux-hwe-edge, linux-azure, linux-gcp, linux-azure-fde, linux-gke, and linux-aws-5.0.
How can administrators identify whether they may be affected?
Review DPLL driver and device lifecycle activity for pins shared across multiple DPLL devices, especially configurations using ref_sync pin pairs. Systems that do not use DPLL devices or do not unregister relevant drivers/devices do not match the described trigger conditions.