Executive brief
A race condition in the Linux kernel's dpll (Distributed PLL) subsystem can cause a NULL pointer dereference crash when a device is unregistered while another driver still holds references to its pins. This can lead to kernel panics and service disruption on systems using dpll-dependent hardware.
Technical details
The vulnerability is a NULL pointer dereference (CWE-476) occurring in the dpll_device_ops() function during a race condition between device unregistration and pin notification processing. The root cause is that when the last owner of a dpll device unregisters while a foreign driver still holds a pin reference via dpll_pin_on_pin_register(), the dpll object remains with an empty registration list. A queued pin notification (e.g., from ice driver reacting to zl3073x_i2c removal) then walks pin->dpll_refs and calls dpll_device_ops() on a missing registration, triggering a WARN_ON and subsequent NULL dereference. The attack vector is local (requires device removal/driver unload) with no authentication required. The fix treats empty registration lists as a legitimate transient state, making dpll_priv() and dpll_device_ops() return NULL instead of dereferencing, and adding NULL checks in all pin netlink paths that resolve devices from pins.
Affected products
- Linux Linux Kernel all versions with dpll subsystem
Timeline
- 2026-09-17: disclosed: Published as CVE-2026-90144