dpll: fix NULL deref in dpll_device_ops() during teardown race
In the Linux kernel, the following vulnerability has been resolved: dpll: fix NULL deref in dpll_device_ops() during teardown race When the last owner of a dpll device unregisters while a foreign driver still holds a pin on it via dpll_pin_on_pin_register(), the dpll object stays alive with an empty registration list. A pin notification queued before the unregister (e.g. ice reacting to zl3073x_i2c removal) then walks pin->dpll_refs into dpll_device_ops(), which trips the WARN_ON and dereferences the missing registration. dpll_lock cannot help because the notification work was queued before the unregistering driver took the lock. Treat the empty registration list as a legitimate transient state. Make dpll_priv() and dpll_device_ops() return NULL in that case and make every pin netlink path that resolves a device from a pin skip such dplls. dpll_cmd_pin_get_one() picks a ref with a live registration and returns -ENODEV when there is none, the pin dumpit skips such a pin instead of aborting the dump, dpll_msg_add_pin_dplls() and the frequency, esync, reference sync and phase adjust set paths skip dead refs, and dpll_pin_parent_device_set() validates the parent with dpll_device_get_by_id(). dpll_pin_register() is the last caller that dereferenced the device ops without a check, so move its frequency monitor validation under dpll_lock and tolerate a missing registration there as well. The empty registration list is equivalent to a cleared DPLL_REGISTERED mark, both transitions ha
CVE-2026-90144
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-90144
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "9431063ad323ac864750aeba4d304389bc42ca4e",
"lessThan": "7d9661d6ef60bee705a3bb220dc59f10d9155c31",
"versionType": "git"
},
{
"status": "affected",
"version": "9431063ad323ac864750aeba4d304389bc42ca4e",
"lessThan": "d39da3ff8d39c31761bf1698bc02a5a206722136",
"versionType": "git"
},
{
"status": "affected",
"version": "9431063ad323ac864750aeba4d304389bc42ca4e",
"lessThan": "fdbf04e3e01a872d0ef2149f846f1a3e3cb54f5b",
"versionType": "git"
},
{
"status": "affected",
"version": "9431063ad323ac864750aeba4d304389bc42ca4e",
"lessThan": "33f016b23a219fe034213849b51436b8e79df251",
"versionType": "git"
}
],
"programFiles": [
"drivers/dpll/dpll_core.c",
"drivers/dpll/dpll_netlink.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.7",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/dpll/dpll_core.c",
"drivers/dpll/dpll_netlink.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-90144
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #48613 · Revision 1
- Added to Heist Feed
- Publisher date