CVE-2026-68378 - Vulnerability Details

- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync()

Description

In the Linux kernel, the following vulnerability has been resolved:

dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync()

When a dpll_pin is shared across multiple dpll_device instances and
those devices are being unregistered (e.g. during driver module removal),
a NULL pointer dereference can occur in dpll_msg_add_pin_ref_sync().

This happens under the following conditions:
- A pin is registered with two or more dpll devices (dpll_A, dpll_B)
- The pin has ref_sync pairs with other pins
- During unregistration of dpll_A's pins, a ref_sync partner pin is
unregistered first, removing it from dpll_A->pin_refs
- But since the partner pin is still registered with dpll_B, its
dpll_refs is not empty, so dpll_pin_ref_sync_pair_del() does NOT
run and the partner stays in the pin's ref_sync_pins xarray
- When the pin itself is then unregistered from dpll_A, the delete
notification calls dpll_msg_add_pin_ref_sync() which finds the
partner in ref_sync_pins, passes dpll_pin_available() (partner is
still registered with dpll_B), but dpll_pin_on_dpll_priv(dpll_A,
partner) returns NULL because partner was already removed from
dpll_A->pin_refs
- The NULL priv pointer is passed to the driver's ref_sync_get
callback, which dereferences it

BUG: kernel NULL pointer dereference, address: 0000000000000034
Oops: Oops: 0000 [#1] SMP NOPTI
RIP: 0010:zl3073x_dpll_input_pin_ref_sync_get+0x73/0x80 [zl3073x]
Call Trace:
dpll_msg_add_pin_ref_sync+0xb8/0x200
dpll_cmd_pin_get_one+0x3b6/0x4b0
dpll_pin_event_send+0x72/0x140
__dpll_pin_unregister+0x5a/0x2b0
dpll_pin_unregister+0x49/0x70

Fix this by skipping ref_sync pins whose priv pointer cannot be resolved
for the current dpll device.

Published: 2026-08-10

Score: 4.1 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

This vulnerability arises from incorrect handling of reference synchronization when DPLL pins are shared across multiple devices during device unregistration. The kernel incorrectly finds a reference that no longer exists, resulting in a NULL pointer dereference within dpll_msg_add_pin_ref_sync(). The crash manifests as a kernel oops. The likely impact is a denial of service due to system crash.

Affected Systems

All Linux systems running kernel versions that have not applied the upstream patch to dpll_msg_add_pin_ref_sync(). The issue affects the core DPLL subsystem regardless of vendor or specific distribution, as it is part of the Linux kernel itself.

Risk and Exploitability

The CVSS score is 4.1 and the EPSS score is < 1%. The vulnerability is not listed in the CISA KEV catalog. The risk is assessed as low based on the available information. No public exploit is known, but the flaw could be triggered by an attacker who can perform module load/unload actions. This inference is based on the description. The likely attack vector requires local or privileged access to perform driver manipulation.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`40466ea1827c46c6435fab9b21b63b80733e2d07`	affected	< 66fbe0499ef517ab161b96c49886a891851f6481
`58256a26bfb37a94738dd65618b1f31f460f8d91`	affected	< 51c2fcc4cd2e4c52bd1970558f6e5356fdc51154
`58256a26bfb37a94738dd65618b1f31f460f8d91`	affected	< 4b3e6b9fdaeb40c6a2f7c41db3888b6ee628bdd2
`58256a26bfb37a94738dd65618b1f31f460f8d91`	affected	< d2e914a4a0d0f753dbae830264850d044026167c

Linux

affected

Version	Status	Constraints
`6.17`	affected	—
`0`	unaffected	< 6.17
`6.18.42`	unaffected	≤ 6.18.*
`7.1.6`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[40466ea1827c46c6435fab9b21b63b80733e2d07,66fbe0499ef517ab161b96c49886a891851f6481)`	affected	code_commit	—
`[58256a26bfb37a94738dd65618b1f31f460f8d91,51c2fcc4cd2e4c52bd1970558f6e5356fdc51154)`	affected	code_commit	—
`[58256a26bfb37a94738dd65618b1f31f460f8d91,4b3e6b9fdaeb40c6a2f7c41db3888b6ee628bdd2)`	affected	code_commit	—
`[58256a26bfb37a94738dd65618b1f31f460f8d91,d2e914a4a0d0f753dbae830264850d044026167c)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.17`	affected	generic	—
`[0,6.17)`	unaffected	generic	—
`[6.18.42,6.19.0)`	unaffected	semver	—
`[7.1.6,7.2.0)`	unaffected	semver	—
`[7.2-rc4,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the kernel to any release that includes the fix to dpll_msg_add_pin_ref_sync().
If a kernel upgrade is not possible, restrict the unload of DPLL-related drivers to trusted administrators and avoid dynamically unloading modules while the pins are in use.
Monitor kernel log messages for oops events to detect any exploitation attempts and apply additional process confinement or intrusion detection as a temporary safeguard.

Generated by OpenCVE AI on August 13, 2026 at 03:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.002.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/4b3e6b9fdaeb40c6a2f7c41db3888b6ee628bdd2
https://git.kernel.org/stable/c/51c2fcc4cd2e4c52bd1970558f6e5356fdc51154
https://git.kernel.org/stable/c/66fbe0499ef517ab161b96c49886a891851f6481
https://git.kernel.org/stable/c/d2e914a4a0d0f753dbae830264850d044026167c
https://nvd.nist.gov/vuln/detail/CVE-2026-68378
https://www.cve.org/CVERecord?id=CVE-2026-68378

History

Wed, 12 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-68378 https://www.cve.org/CVERecord?id=CVE-2026-68378
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Mon, 10 Aug 2026 17:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Mon, 10 Aug 2026 12:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() When a dpll_pin is shared across multiple dpll_device instances and those devices are being unregistered (e.g. during driver module removal), a NULL pointer dereference can occur in dpll_msg_add_pin_ref_sync(). This happens under the following conditions: - A pin is registered with two or more dpll devices (dpll_A, dpll_B) - The pin has ref_sync pairs with other pins - During unregistration of dpll_A's pins, a ref_sync partner pin is unregistered first, removing it from dpll_A->pin_refs - But since the partner pin is still registered with dpll_B, its dpll_refs is not empty, so dpll_pin_ref_sync_pair_del() does NOT run and the partner stays in the pin's ref_sync_pins xarray - When the pin itself is then unregistered from dpll_A, the delete notification calls dpll_msg_add_pin_ref_sync() which finds the partner in ref_sync_pins, passes dpll_pin_available() (partner is still registered with dpll_B), but dpll_pin_on_dpll_priv(dpll_A, partner) returns NULL because partner was already removed from dpll_A->pin_refs - The NULL priv pointer is passed to the driver's ref_sync_get callback, which dereferences it BUG: kernel NULL pointer dereference, address: 0000000000000034 Oops: Oops: 0000 [#1] SMP NOPTI RIP: 0010:zl3073x_dpll_input_pin_ref_sync_get+0x73/0x80 [zl3073x] Call Trace: dpll_msg_add_pin_ref_sync+0xb8/0x200 dpll_cmd_pin_get_one+0x3b6/0x4b0 dpll_pin_event_send+0x72/0x140 __dpll_pin_unregister+0x5a/0x2b0 dpll_pin_unregister+0x49/0x70 Fix this by skipping ref_sync pins whose priv pointer cannot be resolved for the current dpll device.
Title		dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/4b3e6b9fdaeb40c6a2f7c41db3888b6ee628bdd2 https://git.kernel.org/stable/c/51c2fcc4cd2e4c52bd1970558f6e5356fdc51154 https://git.kernel.org/stable/c/66fbe0499ef517ab161b96c49886a891851f6481 https://git.kernel.org/stable/c/d2e914a4a0d0f753dbae830264850d044026167c

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-10T12:03:56.590Z

Updated: 2026-08-17T05:04:24.219Z

Reserved: 2026-07-30T09:28:09.387Z

Link: CVE-2026-68378

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-10T13:20:30.813

Modified: 2026-08-17T06:17:46.260

Link: CVE-2026-68378

Redhat

Severity : Moderate

Publid Date: 2026-08-10T12:03:56Z

Links: CVE-2026-68378 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-13T03:45:02Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object