CVE-2026-23129: Linux Kernel Privilege Escalation Flaw

CVE-2026-23129 Overview

CVE-2026-23129 affects the Digital Phase-Locked Loop (DPLL) subsystem in the Linux kernel. The flaw resides in the internal registration helpers dpll_xa_ref_dpll_add() and dpll_xa_ref_pin_add(). These helpers previously accepted duplicate registration attempts for the same pin on the same device. The core silently incremented the reference count rather than rejecting the request. This mismatch between allocation and reference counting causes a kernel warning during unregistration and leads to a denial-of-service condition.

The vulnerability impacts Linux kernel versions including 6.19-rc1 through 6.19-rc6. A local authenticated user with the ability to interact with the DPLL subsystem can trigger the inconsistent state.

Critical Impact
A local low-privileged caller can trigger kernel warnings and disrupt DPLL subsystem availability through duplicate pin registrations.

Affected Products

Linux Kernel 6.19-rc1 through 6.19-rc6
Linux Kernel branches containing the dpll subsystem prior to the fix
Distributions shipping mainline linux_kernel builds with DPLL support

Discovery Timeline

2026-02-14 - CVE-2026-23129 published to NVD
2026-03-18 - Last updated in NVD database

Technical Details for CVE-2026-23129

Vulnerability Analysis

The DPLL subsystem manages phase-locked loop devices used for hardware timing synchronization. Kernel drivers register pins through helper functions exposed by the DPLL core. The functions dpll_xa_ref_dpll_add() and dpll_xa_ref_pin_add() track registrations using an XArray and a reference count.

When a caller registered the same pin with matching ops, priv, and cookie parameters, the core treated the call as valid. The first registration allocated a dpll_pin_registration structure. Subsequent duplicate calls only incremented the dpll_pin_ref.refcount without allocating new registration structures.

The inconsistency surfaced during teardown. The first unregister call freed the dpll_pin_registration. Later unregister calls found no corresponding allocation and triggered a WARN in the kernel log. This indicates a logic error in lifecycle management within the registration helpers.

Root Cause

The root cause is missing duplicate-detection logic in the internal registration helpers. The helpers conflated reference counting with registration tracking. They incremented refcounts on duplicate calls instead of returning an error.

Attack Vector

Exploitation requires local access and the ability to invoke kernel paths that perform DPLL pin registration. A buggy or malicious driver invoking duplicate registrations triggers the inconsistent state. The resulting WARN impacts kernel reliability and can be leveraged for availability impact on systems where DPLL is in active use. The vulnerability is classified under [NVD-CWE-Other] and reflects a kernel resource management defect. No public proof-of-concept code is available, and the EPSS data does not indicate active exploitation interest.

Detection Methods for CVE-2026-23129

Indicators of Compromise

Kernel log entries containing WARN traces originating from dpll_pin_unregister or related DPLL teardown paths
Unexpected refcount imbalance messages tied to DPLL pin or device structures
Kernel taint flags set after DPLL driver load or unload sequences

Detection Strategies

Monitor dmesg and journalctl -k output for warnings referencing dpll_xa_ref_dpll_add or dpll_xa_ref_pin_add
Audit loaded kernel modules that interact with the DPLL subsystem and verify their patch level
Correlate driver load events with subsequent kernel warnings to identify duplicate registration patterns

Monitoring Recommendations

Forward kernel logs to a centralized logging platform and alert on WARN_ON traces from networking and timing subsystems
Track kernel version inventory across hosts to confirm patched builds are deployed
Baseline DPLL-related warnings to detect anomalous spikes following driver updates

How to Mitigate CVE-2026-23129

Immediate Actions Required

Apply the upstream kernel patches referenced by the mainline commits as soon as distribution updates become available
Restrict local access to systems running affected 6.19-rc kernels, particularly those using DPLL-capable network interface cards
Review third-party drivers that interact with DPLL pins to ensure they do not issue duplicate registration calls

Patch Information

The fix updates dpll_xa_ref_dpll_add() and dpll_xa_ref_pin_add() to return -EEXIST when a matching registration is detected. This enforces a strict register-once policy. Patches are available in the upstream Linux kernel:

Workarounds

Avoid running release candidate kernels (6.19-rc1 through 6.19-rc6) in production environments
Unload or disable kernel modules that perform redundant DPLL pin registrations until the patch is applied
Limit local user privileges and restrict access to interfaces that can trigger DPLL registration paths

bash

# Verify the running kernel version against affected builds
uname -r

# Check for DPLL-related warnings in kernel logs
dmesg | grep -i dpll
journalctl -k --since "24 hours ago" | grep -Ei 'dpll|WARN'