« Volver al listado

CVE-2026-68378

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync()

When a dpll_pin is shared across multiple dpll_device instances and those devices are being unregistered (e.g. during driver module removal), a NULL pointer dereference can occur in dpll_msg_add_pin_ref_sync().

Fix this by skipping ref_sync pins whose priv pointer cannot be resolved for the current dpll device.

Detalles técnicos trazas, registros y código del informe original
This happens under the following conditions:
 - A pin is registered with two or more dpll devices (dpll_A, dpll_B)
 - The pin has ref_sync pairs with other pins
 - During unregistration of dpll_A's pins, a ref_sync partner pin is
   unregistered first, removing it from dpll_A->pin_refs
 - But since the partner pin is still registered with dpll_B, its
   dpll_refs is not empty, so dpll_pin_ref_sync_pair_del() does NOT
   run and the partner stays in the pin's ref_sync_pins xarray
 - When the pin itself is then unregistered from dpll_A, the delete
   notification calls dpll_msg_add_pin_ref_sync() which finds the
   partner in ref_sync_pins, passes dpll_pin_available() (partner is
   still registered with dpll_B), but dpll_pin_on_dpll_priv(dpll_A,
   partner) returns NULL because partner was already removed from
   dpll_A->pin_refs
 - The NULL priv pointer is passed to the driver's ref_sync_get
   callback, which dereferences it

 BUG: kernel NULL pointer dereference, address: 0000000000000034
 Oops: Oops: 0000 [#1] SMP NOPTI
 RIP: 0010:zl3073x_dpll_input_pin_ref_sync_get+0x73/0x80 [zl3073x]
 Call Trace:
  dpll_msg_add_pin_ref_sync+0xb8/0x200
  dpll_cmd_pin_get_one+0x3b6/0x4b0
  dpll_pin_event_send+0x72/0x140
  __dpll_pin_unregister+0x5a/0x2b0
  dpll_pin_unregister+0x49/0x70

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-68378",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "40466ea1827c46c6435fab9b21b63b80733e2d07",
              "lessThan": "66fbe0499ef517ab161b96c49886a891851f6481",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "58256a26bfb37a94738dd65618b1f31f460f8d91",
              "lessThan": "51c2fcc4cd2e4c52bd1970558f6e5356fdc51154",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "58256a26bfb37a94738dd65618b1f31f460f8d91",
              "lessThan": "4b3e6b9fdaeb40c6a2f7c41db3888b6ee628bdd2",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "58256a26bfb37a94738dd65618b1f31f460f8d91",
              "lessThan": "d2e914a4a0d0f753dbae830264850d044026167c",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/dpll/dpll_netlink.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.17"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.17",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/dpll/dpll_netlink.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-08-10T13:20:30.813",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/4b3e6b9fdaeb40c6a2f7c41db3888b6ee628bdd2",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/51c2fcc4cd2e4c52bd1970558f6e5356fdc51154",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/66fbe0499ef517ab161b96c49886a891851f6481",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d2e914a4a0d0f753dbae830264850d044026167c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync()\n\nWhen a dpll_pin is shared across multiple dpll_device instances and\nthose devices are being unregistered (e.g. during driver module removal),\na NULL pointer dereference can occur in dpll_msg_add_pin_ref_sync().\n\nThis happens under the following conditions:\n - A pin is registered with two or more dpll devices (dpll_A, dpll_B)\n - The pin has ref_sync pairs with other pins\n - During unregistration of dpll_A's pins, a ref_sync partner pin is\n   unregistered first, removing it from dpll_A->pin_refs\n - But since the partner pin is still registered with dpll_B, its\n   dpll_refs is not empty, so dpll_pin_ref_sync_pair_del() does NOT\n   run and the partner stays in the pin's ref_sync_pins xarray\n - When the pin itself is then unregistered from dpll_A, the delete\n   notification calls dpll_msg_add_pin_ref_sync() which finds the\n   partner in ref_sync_pins, passes dpll_pin_available() (partner is\n   still registered with dpll_B), but dpll_pin_on_dpll_priv(dpll_A,\n   partner) returns NULL because partner was already removed from\n   dpll_A->pin_refs\n - The NULL priv pointer is passed to the driver's ref_sync_get\n   callback, which dereferences it\n\n BUG: kernel NULL pointer dereference, address: 0000000000000034\n Oops: Oops: 0000 [#1] SMP NOPTI\n RIP: 0010:zl3073x_dpll_input_pin_ref_sync_get+0x73/0x80 [zl3073x]\n Call Trace:\n  dpll_msg_add_pin_ref_sync+0xb8/0x200\n  dpll_cmd_pin_get_one+0x3b6/0x4b0\n  dpll_pin_event_send+0x72/0x140\n  __dpll_pin_unregister+0x5a/0x2b0\n  dpll_pin_unregister+0x49/0x70\n\nFix this by skipping ref_sync pins whose priv pointer cannot be resolved\nfor the current dpll device."
    }
  ],
  "lastModified": "2026-08-17T06:17:46.260",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}