{"id":"CVE-2026-63977","title":"dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndpll: zl3073x: use __dpll_device_change_ntf() and remove change_work\n\nThe change_work was introduced to send device change notifications\nfrom DPLL device callbacks with…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 9363b4837659d1b7ee04cfa714373ce4b4b8269f < e7a33807fb3f87a855993474ac21684ce105927b","Linux >= 9363b4837659d1b7ee04cfa714373ce4b4b8269f < d733f519f6443540f8359461a34e3b0042099bbe","Linux 6.18"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:34:28.879643Z"},"published":"2026-07-19","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:42:15.726Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-63977","references":[{"url":"https://git.kernel.org/stable/c/e7a33807fb3f87a855993474ac21684ce105927b"},{"url":"https://git.kernel.org/stable/c/d733f519f6443540f8359461a34e3b0042099bbe"}],"tags":["cve.org"],"epss":0.00165,"epssPercentile":0.05353,"ingestedAt":"2026-10-16T17:24:46.786Z","slug":"CVE-2026-63977","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndpll: zl3073x: use __dpll_device_change_ntf() and remove change_work\n\nThe change_work was introduced to send device change notifications\nfrom DPLL device callbacks without deadlocking on dpll_lock, since\nthe callbacks are already invoked under that lock. Now that\n__dpll_device_change_ntf() is exported for callers that already\nhold dpll_lock, use it directly and remove the change_work\ninfrastructure entirely.\n\nThis eliminates a race condition where change_work could be\nre-scheduled after cancel_work_sync() during device teardown,\npotentially causing the handler to dereference a freed or NULL\ndpll_dev pointer.\n\n## Affected\n\n- `Linux >= 9363b4837659d1b7ee04cfa714373ce4b4b8269f < e7a33807fb3f87a855993474ac21684ce105927b`\n- `Linux >= 9363b4837659d1b7ee04cfa714373ce4b4b8269f < d733f519f6443540f8359461a34e3b0042099bbe`\n- `Linux 6.18`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}