VulnerabilityPublished 17 Sep 2026Updated 21 Oct 2026

CVE-2026-90144: Linux kernel · dpll: fix NULL deref in dpll_device_ops() during teardown race

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in fdbf04e3e01a872d0ef2149f846f1a3e3cb54f5b : update Linux kernel when convenient.

Data as of 26 Oct 2026, 13:47 UTC

Severity

Unrated

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS: 0.2% chance of exploitation in 30 days – higher than 10% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in fdbf04e3e01a872d0ef2149f846f1a3e3cb54f5b, d39da3ff8d39c31761bf1698bc02a5a206722136, 33f016b23a219fe034213849b51436b8e79df251 +1

Exploitation evidence

Disclosed: evidence found.
CVE published 17 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Linux kernel to fdbf04e3e01a872d0ef2149f846f1a3e3cb54f5b, d39da3ff8d39c31761bf1698bc02a5a206722136, 33f016b23a219fe034213849b51436b8e79df251 or 7d9661d6ef60bee705a3bb220dc59f10d9155c31.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 9431063ad323ac864750aeba4d304389bc42ca4e, < fdbf04e3e01a872d0ef2149f846f1a3e3cb54f5b	Fixed in fdbf04e3e01a872d0ef2149f846f1a3e3cb54f5b
LinuxLinux	Affected ≥ 9431063ad323ac864750aeba4d304389bc42ca4e, < d39da3ff8d39c31761bf1698bc02a5a206722136	Fixed in d39da3ff8d39c31761bf1698bc02a5a206722136
LinuxLinux	Affected ≥ 9431063ad323ac864750aeba4d304389bc42ca4e, < 33f016b23a219fe034213849b51436b8e79df251	Fixed in 33f016b23a219fe034213849b51436b8e79df251
LinuxLinux	Affected ≥ 9431063ad323ac864750aeba4d304389bc42ca4e, < 7d9661d6ef60bee705a3bb220dc59f10d9155c31	Fixed in 7d9661d6ef60bee705a3bb220dc59f10d9155c31
LinuxLinux	Affected =6.7	Fixed in–

Description

In the Linux kernel, the following vulnerability has been resolved: dpll: fix NULL deref in dpll_device_ops() during teardown race When the last owner of a dpll device unregisters while a foreign driver still holds a pin on it via dpll_pin_on_pin_register(), the dpll object stays alive with an empty registration list. A pin notification queued before the unregister (e.g. ice reacting to zl3073x_i2c removal) then walks pin->dpll_refs into dpll_device_ops(), which trips the WARN_ON and dereferences the missing registration. dpll_lock cannot help because the notification work was queued before the unregistering driver took the lock. Treat the empty registration list as a legitimate transient state. Make dpll_priv() and dpll_device_ops() return NULL in that case and make every pin netlink path that resolves a device from a pin skip such dplls. dpll_cmd_pin_get_one() picks a ref with a live registration and returns -ENODEV when there is none, the pin dumpit skips such a pin instead of aborting the dump, dpll_msg_add_pin_dplls() and the frequency, esync, reference sync and phase adjust set paths skip dead refs, and dpll_pin_parent_device_set() validates the parent with dpll_device_get_by_id(). dpll_pin_register() is the last caller that dereferenced the device ops without a check, so move its frequency monitor validation under dpll_lock and tolerate a missing registration there as well. The empty registration list is equivalent to a cleared DPLL_REGISTERED mark, both transitions happen under dpll_lock in dpll_device_register() and dpll_device_unregister(). A pin notification for a pin whose dplls are all gone is now dropped with -ENODEV instead of crashing, all callers in the core ignore that return value. WARNING: drivers/dpll/dpll_core.c:1092 at dpll_device_ops+0x24/0x40, CPU#83: kworker/u576:3/23471 Modules linked in: ... ice ... zl3073x_i2c(-) ... zl3073x ... Workqueue: ice_dpll_wq ice_dpll_pin_notify_work [ice] RIP: 0010:dpll_device_ops+0x24/0x40 Call Trace: <TASK> dpll_cmd_pin_get_one+0x336/0x520 dpll_pin_event_send+0x82/0x140 dpll_pin_on_pin_unregister+0xbb/0x160 ice_dpll_pin_notify_work+0x1bc/0x1f0 [ice] process_one_work+0x19e/0x370 worker_thread+0x1a6/0x310 kthread+0xe4/0x120 ret_from_fork+0x1a1/0x270 ret_from_fork_asm+0x1a/0x30 </TASK> ---[ end trace 0000000000000000 ]--- BUG: kernel NULL pointer dereference, address: 0000000000000010 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page

References

Community reviews

Loading reviews…