CVE-2026-68378 Overview
CVE-2026-68378 is a NULL pointer dereference vulnerability in the Linux kernel's Digital Phase-Locked Loop (DPLL) subsystem. The flaw resides in the dpll_msg_add_pin_ref_sync() function and triggers when a dpll_pin is shared across multiple dpll_device instances during unregistration events, such as driver module removal. The kernel dereferences a NULL priv pointer passed to the driver's ref_sync_get callback, producing an oops and destabilizing the affected system. The issue was observed on systems using the zl3073x DPLL driver but affects the generic DPLL netlink code path.
Critical Impact
A local trigger during driver unregistration causes a kernel NULL pointer dereference at address 0x34, resulting in an oops and potential denial of service on affected Linux hosts.
Affected Products
- Linux kernel with DPLL subsystem enabled
- Systems using the zl3073x DPLL driver where pins are shared across multiple dpll_device instances
- Networking and timing hardware relying on shared DPLL pin ref_sync pairs
Discovery Timeline
- 2026-08-10 - CVE-2026-68378 published to NVD
- 2026-08-10 - Last updated in NVD database
Technical Details for CVE-2026-68378
Vulnerability Analysis
The DPLL subsystem manages shared pin references between multiple DPLL device instances using the pin_refs and ref_sync_pins xarrays. When a pin participates in a ref_sync pair with another pin and both belong to more than one DPLL device, the cleanup path during device unregistration leaves stale references. The function dpll_msg_add_pin_ref_sync() retrieves partner pins from ref_sync_pins, validates them with dpll_pin_available(), and then calls dpll_pin_on_dpll_priv() to obtain the driver private pointer for the current DPLL context.
Because the partner pin was already removed from dpll_A->pin_refs while still registered with dpll_B, the private pointer lookup returns NULL. The kernel then forwards this NULL pointer to the driver callback zl3073x_dpll_input_pin_ref_sync_get(), which dereferences it and triggers the oops.
Root Cause
The root cause is an inconsistent cleanup ordering in the DPLL pin ref_sync teardown logic. dpll_pin_ref_sync_pair_del() skips execution when a partner pin still has entries in its dpll_refs, leaving the partner in the ref_sync_pins xarray. Subsequent unregister notifications look up the partner's private data for a DPLL device that no longer holds a reference, returning NULL without any downstream check before the driver callback dereferences it.
Attack Vector
Triggering the flaw requires local kernel-level activity — specifically, unregistering DPLL pins from a device that shares pins with another DPLL device. This is typically initiated through driver module removal or device teardown. The bug is not remotely exploitable and requires privileged access to load or unload kernel modules. Consult the Linux Kernel Commit fix for the exact code path.
The kernel oops trace observed during exploitation traverses dpll_pin_unregister → __dpll_pin_unregister → dpll_pin_event_send → dpll_cmd_pin_get_one → dpll_msg_add_pin_ref_sync → the driver's ref_sync_get callback, where the NULL dereference occurs at address 0x34.
Detection Methods for CVE-2026-68378
Indicators of Compromise
- Kernel oops log entries referencing dpll_msg_add_pin_ref_sync+0xb8/0x200 in the call trace
- BUG messages showing kernel NULL pointer dereference, address: 0000000000000034
- Crash frames involving zl3073x_dpll_input_pin_ref_sync_get or similar driver ref_sync_get callbacks
- Unexpected system panics or resets coinciding with DPLL driver module unload events
Detection Strategies
- Monitor kernel ring buffer (dmesg) and /var/log/messages for oops signatures containing the DPLL call trace above.
- Correlate kernel crash telemetry with events involving modprobe -r or rmmod targeting DPLL-related drivers such as zl3073x.
- Track kernel version inventory across networking and timing hosts to identify systems running vulnerable DPLL code.
Monitoring Recommendations
- Enable kdump or equivalent crash-capture tooling on hosts using DPLL hardware to preserve forensic evidence.
- Ingest kernel logs into a centralized logging pipeline and alert on oops messages containing dpll_ symbols.
- Audit module load and unload activity on production hosts using auditd rules on init_module and delete_module syscalls.
How to Mitigate CVE-2026-68378
Immediate Actions Required
- Apply the upstream kernel patches referenced in the fix commits as soon as vendor-supplied backports are available.
- Avoid unloading DPLL driver modules on production systems until patches are deployed.
- Inventory hosts running the zl3073x driver or other DPLL drivers that use shared pins with ref_sync pairs.
Patch Information
The fix skips ref_sync partner pins whose priv pointer cannot be resolved for the current DPLL device, preventing the NULL pointer from reaching the driver callback. Patches are available in the following stable tree commits: 4b3e6b9fdaeb, 51c2fcc4cd2e, 66fbe0499ef5, and d2e914a4a0d0. Apply the appropriate commit for your stable kernel branch.
Workarounds
- Restrict access to module management commands by limiting root and CAP_SYS_MODULE privileges to trusted operators only.
- Avoid configurations that register the same DPLL pin across multiple dpll_device instances with ref_sync pairs until patched.
- Schedule DPLL driver reloads during maintenance windows with crash-recovery procedures in place.
# Verify running kernel version and check for the fix
uname -r
# List loaded DPLL-related modules
lsmod | grep -Ei 'dpll|zl3073x'
# Restrict module removal capability to root only (audit rule example)
auditctl -a always,exit -F arch=b64 -S delete_module -k module_unload
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
