PT-2026-61294 · Linux · Linux

CVE-2026-63977 · Publicado 2026-07-19 · Atualizado 2026-07-19

Mitre

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In the Linux kernel, the following vulnerability has been resolved:

dpll: zl3073x: use dpll device change ntf() and remove change work

The change work was introduced to send device change notifications from DPLL device callbacks without deadlocking on dpll lock, since the callbacks are already invoked under that lock. Now that dpll device change ntf() is exported for callers that already hold dpll lock, use it directly and remove the change work infrastructure entirely.

This eliminates a race condition where change work could be re-scheduled after cancel work sync() during device teardown, potentially causing the handler to dereference a freed or NULL dpll dev pointer.

Correção

Identificadores relacionados

CVE-2026-63977

Produtos afetados

Linux

Referências · 3

• https://git.kernel.org/stable/c/e7a33807fb3f87a855993474ac21684ce105927b · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-63977 · Nota de Segurança
• https://git.kernel.org/stable/c/d733f519f6443540f8359461a34e3b0042099bbe · Nota