Executive brief
A vulnerability was identified in the Linux kernel's handling of certain synchronization hardware (DPLL devices). A race condition during device shutdown could lead to a system crash or unpredictable behavior when the system attempts to access memory that has already been cleared. This issue primarily affects systems using specific network timing hardware drivers.
Technical details
A race condition exists in the zl3073x DPLL driver within the Linux kernel. The vulnerability stems from the 'change_work' infrastructure, which could be re-scheduled after 'cancel_work_sync()' is called during device teardown. This allows a worker thread to execute and dereference a 'dpll_dev' pointer that has already been freed or set to NULL. The fix involves removing the asynchronous 'change_work' mechanism in favor of using the exported '__dpll_device_change_ntf()' function, which can be safely called while holding the 'dpll_lock'. This issue is resolved in kernel versions 7.0.12 and 7.1.
Affected products
- Linux Linux Kernel 6.18 to 7.0.11, 7.1
Timeline
- 2026-05-26: disclosed: Initial patch authored
- 2026-07-19: advisory: CVE published by NVD