Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work The… (CVE-2026-63977)

The Linux kernel vulnerability CVE-2026-63977 involves a race condition in the DPLL zl3073x driver where the previous use of a deferred work mechanism (change_work) to send device change notifications could be re-scheduled after cancel_work_sync() during device teardown. This could lead to the handler dereferencing a freed or NULL dpll_dev pointer, causing instability or potential privilege escalation. The fix replaces the deferred work with a direct call to the exported __dpll_device_change_ntf() function, which is safe to call when holding dpll_lock, thereby removing the race condition. This vulnerability affects many specific kernel versions prior to 7.0.0-28.28.1 and related builds. The vendor advisory from Ubuntu confirms the availability of patches and recommends updating to fixed package versions and rebooting the system.

Exploitation of this race condition could cause kernel crashes or memory corruption by dereferencing invalid pointers during device teardown. This may lead to system instability or potentially privilege escalation if exploited by a local attacker. The CVSS score of 7.8 indicates high impact on confidentiality, integrity, and availability, but the attack vector is local with low privileges required and no user interaction needed.

A patch is available and should be applied by updating the Linux kernel to the fixed versions provided by the vendor. After applying the update, a system reboot is required to activate the fix. Due to an ABI change, all third-party kernel modules must be recompiled and reinstalled. Follow the vendor's update instructions carefully to ensure full remediation.