CVE-2026-63977: Linux Kernel Race Condition Vulnerability

CVE-2026-63977 Overview

CVE-2026-63977 is a race condition vulnerability in the Linux kernel's Digital Phase-Locked Loop (DPLL) subsystem, specifically in the zl3073x driver. The flaw stems from change_work being re-scheduled after cancel_work_sync() during device teardown, which can cause the handler to dereference a freed or NULL dpll_dev pointer. Exploitation requires local access with low privileges and can lead to kernel memory corruption impacting confidentiality, integrity, and availability. The upstream fix removes the change_work infrastructure entirely and instead calls __dpll_device_change_ntf() directly, since that function is now exported for callers already holding dpll_lock.

Critical Impact
A local, low-privileged attacker can trigger a use-after-free or NULL pointer dereference in the DPLL zl3073x driver during device teardown, resulting in kernel instability or potential privilege escalation.

Affected Products

Linux kernel versions containing the dpll: zl3073x driver prior to commit e7a33807fb3f87a855993474ac21684ce105927b
Stable kernel branches referenced by commit d733f519f6443540f8359461a34e3b0042099bbe
Distributions shipping the affected zl3073x DPLL driver

Discovery Timeline

2026-07-19 - CVE-2026-63977 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63977

Vulnerability Analysis

The vulnerability resides in the zl3073x DPLL driver within the Linux kernel networking timing subsystem. The change_work mechanism was originally introduced to send device change notifications from DPLL callbacks without deadlocking on dpll_lock, because those callbacks already execute under that lock. This deferred work approach created a lifetime management flaw during device teardown.

When the driver tears down a DPLL device, it calls cancel_work_sync() to stop pending notification work. However, the design allowed change_work to be re-scheduled after this cancellation completed. The subsequent handler execution then operated on a dpll_dev pointer that had already been freed or set to NULL, producing a use-after-free or NULL pointer dereference in kernel context.

The fix removes the change_work infrastructure entirely. Callers that already hold dpll_lock now invoke the exported __dpll_device_change_ntf() function directly, eliminating the deferred-work race window.

Root Cause

The root cause is a race condition between deferred work re-scheduling and device teardown. cancel_work_sync() does not prevent new work from being queued after it returns, so the handler could dereference a stale dpll_dev pointer after the device structure was released.

Attack Vector

Exploitation requires local access with low privileges on a system running the affected zl3073x DPLL driver. An attacker triggers driver operations that cause change_work to be queued concurrently with device removal or reconfiguration, racing the teardown path to hit the freed pointer.

No verified public exploit code is available. Refer to the kernel git commit fix and the related stable commit for the authoritative patch details.

Detection Methods for CVE-2026-63977

Indicators of Compromise

Kernel oops or panic messages referencing change_work, dpll_device_change_ntf, or the zl3073x module in dmesg and /var/log/kern.log
Unexpected NULL pointer dereference stack traces originating from the DPLL subsystem during device add/remove events
System instability or crashes on hosts using ZL3073x-based timing hardware

Detection Strategies

Inventory Linux hosts that load the zl3073x kernel module and compare running kernel versions against patched builds
Monitor kernel ring buffer telemetry for crash signatures involving DPLL notification handlers
Correlate driver unbind or hot-plug events with kernel fault traces to identify race-condition triggers

Monitoring Recommendations

Forward kernel.* syslog facility events to a centralized logging platform for stack trace analysis
Alert on repeated module load/unload sequences targeting zl3073x from non-administrative sessions
Track unexpected reboots or watchdog-triggered restarts on telecom, 5G, or precision timing infrastructure hosts

How to Mitigate CVE-2026-63977

Immediate Actions Required

Apply the upstream kernel patch from commit e7a33807fb3f87a855993474ac21684ce105927b or update to a distribution kernel that includes the fix
Restrict local shell access on systems running the zl3073x driver to trusted administrators only
Audit which production hosts load the zl3073x module and prioritize those for patching

Patch Information

The fix removes the change_work infrastructure and uses __dpll_device_change_ntf() directly from callers already holding dpll_lock. Reference the Kernel Git Commit Fix and the Kernel Git Commit Update for backporting.

Workarounds

Unload the zl3073x kernel module on systems that do not require ZL3073x DPLL functionality using modprobe -r zl3073x
Blacklist the zl3073x module in /etc/modprobe.d/ on hosts where the timing hardware is not present
Limit access to DPLL netlink interfaces via kernel capability restrictions until the patched kernel is deployed

bash

# Configuration example: blacklist the vulnerable module until patched
echo "blacklist zl3073x" | sudo tee /etc/modprobe.d/cve-2026-63977.conf
sudo modprobe -r zl3073x
sudo update-initramfs -u