CVE-2026-23129
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
14/02/2026
Last modified:
18/03/2026
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
dpll: Prevent duplicate registrations<br />
<br />
Modify the internal registration helpers dpll_xa_ref_{dpll,pin}_add()<br />
to reject duplicate registration attempts.<br />
<br />
Previously, if a caller attempted to register the same pin multiple<br />
times (with the same ops, priv, and cookie) on the same device, the core<br />
silently increments the reference count and return success. This behavior<br />
is incorrect because if the caller makes these duplicate registrations<br />
then for the first one dpll_pin_registration is allocated and for others<br />
the associated dpll_pin_ref.refcount is incremented. During the first<br />
unregistration the associated dpll_pin_registration is freed and for<br />
others WARN is fired.<br />
<br />
Fix this by updating the logic to return `-EEXIST` if a matching<br />
registration is found to enforce a strict "register once" policy.
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.7 (including) | 6.12.68 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.13 (including) | 6.18.8 (excluding) |
| cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page



