---
id: CVE-2026-90144
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  dpll: fix NULL deref in dpll_device_ops() during teardown race

  When the last owner of a dpll device unregisters while a foreign driver
  still holds a pin on it via dpll…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  dpll: fix NULL deref in dpll_device_ops() during teardown race

  When the last owner of a dpll device unregisters while a foreign driver
  still holds a pin on it via dpll…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 9431063ad323ac864750aeba4d304389bc42ca4e <
    fdbf04e3e01a872d0ef2149f846f1a3e3cb54f5b
  - >-
    Linux >= 9431063ad323ac864750aeba4d304389bc42ca4e <
    33f016b23a219fe034213849b51436b8e79df251
  - Linux 6.7
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T17:17:07.233'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90144'
references:
  - url: 'https://git.kernel.org/stable/c/33f016b23a219fe034213849b51436b8e79df251'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/fdbf04e3e01a872d0ef2149f846f1a3e3cb54f5b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-17T16:21:47.876Z'
epss: 0.00198
epssPercentile: 0.08474
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

dpll: fix NULL deref in dpll_device_ops() during teardown race

When the last owner of a dpll device unregisters while a foreign driver
still holds a pin on it via dpll_pin_on_pin_register(), the dpll object
stays alive with an empty registration list. A pin notification queued
before the unregister (e.g. ice reacting to zl3073x_i2c removal) then
walks pin->dpll_refs into dpll_device_ops(), which trips the WARN_ON and
dereferences the missing registration. dpll_lock cannot help because the
notification work was queued before the unregistering driver took the
lock.

Treat the empty registration list as a legitimate transient state. Make
dpll_priv() and dpll_device_ops() return NULL in that case and make
every pin netlink path that resolves a device from a pin skip such
dplls. dpll_cmd_pin_get_one() picks a ref with a live registration and
returns -ENODEV when there is none, the pin dumpit skips such a pin
instead of aborting the dump, dpll_msg_add_pin_dplls() and the
frequency, esync, reference sync and phase adjust set paths skip dead
refs, and dpll_pin_parent_device_set() validates the parent with
dpll_device_get_by_id(). dpll_pin_register() is the last caller that
dereferenced the device ops without a check, so move its frequency
monitor validation under dpll_lock and tolerate a missing registration
there as well.

The empty registration list is equivalent to a cleared DPLL_REGISTERED
mark, both transitions happen under dpll_lock in dpll_device_register()
and dpll_device_unregister(). A pin notification for a pin whose dplls
are all gone is now dropped with -ENODEV instead of crashing, all
callers in the core ignore that return value.

 WARNING: drivers/dpll/dpll_core.c:1092 at dpll_device_ops+0x24/0x40,
 CPU#83: kworker/u576:3/23471
 Modules linked in: ... ice ... zl3073x_i2c(-) ... zl3073x ...
 Workqueue: ice_dpll_wq ice_dpll_pin_notify_work [ice]
 RIP: 0010:dpll_device_ops+0x24/0x40
 Call Trace:
  <TASK>
  dpll_cmd_pin_get_one+0x336/0x520
  dpll_pin_event_send+0x82/0x140
  dpll_pin_on_pin_unregister+0xbb/0x160
  ice_dpll_pin_notify_work+0x1bc/0x1f0 [ice]
  process_one_work+0x19e/0x370
  worker_thread+0x1a6/0x310
  kthread+0xe4/0x120
  ret_from_fork+0x1a1/0x270
  ret_from_fork_asm+0x1a/0x30
  </TASK>
 ---[ end trace 0000000000000000 ]---
 BUG: kernel NULL pointer dereference, address: 0000000000000010
 #PF: supervisor read access in kernel mode
 #PF: error_code(0x0000) - not-present page

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.