CVE-2026-68378

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync()<br /> <br /> When a dpll_pin is shared across multiple dpll_device instances and<br /> those devices are being unregistered (e.g. during driver module removal),<br /> a NULL pointer dereference can occur in dpll_msg_add_pin_ref_sync().<br /> <br /> This happens under the following conditions:<br /> - A pin is registered with two or more dpll devices (dpll_A, dpll_B)<br /> - The pin has ref_sync pairs with other pins<br /> - During unregistration of dpll_A&amp;#39;s pins, a ref_sync partner pin is<br /> unregistered first, removing it from dpll_A-&gt;pin_refs<br /> - But since the partner pin is still registered with dpll_B, its<br /> dpll_refs is not empty, so dpll_pin_ref_sync_pair_del() does NOT<br /> run and the partner stays in the pin&amp;#39;s ref_sync_pins xarray<br /> - When the pin itself is then unregistered from dpll_A, the delete<br /> notification calls dpll_msg_add_pin_ref_sync() which finds the<br /> partner in ref_sync_pins, passes dpll_pin_available() (partner is<br /> still registered with dpll_B), but dpll_pin_on_dpll_priv(dpll_A,<br /> partner) returns NULL because partner was already removed from<br /> dpll_A-&gt;pin_refs<br /> - The NULL priv pointer is passed to the driver&amp;#39;s ref_sync_get<br /> callback, which dereferences it<br /> <br /> BUG: kernel NULL pointer dereference, address: 0000000000000034<br /> Oops: Oops: 0000 [#1] SMP NOPTI<br /> RIP: 0010:zl3073x_dpll_input_pin_ref_sync_get+0x73/0x80 [zl3073x]<br /> Call Trace:<br /> dpll_msg_add_pin_ref_sync+0xb8/0x200<br /> dpll_cmd_pin_get_one+0x3b6/0x4b0<br /> dpll_pin_event_send+0x72/0x140<br /> __dpll_pin_unregister+0x5a/0x2b0<br /> dpll_pin_unregister+0x49/0x70<br /> <br /> Fix this by skipping ref_sync pins whose priv pointer cannot be resolved<br /> for the current dpll device.