CVE-2026-68378

In the Linux kernel, the following vulnerability has been resolved:

dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync()

When a dpll_pin is shared across multiple dpll_device instances and

those devices are being unregistered (e.g. during driver module removal),

a NULL pointer dereference can occur in dpll_msg_add_pin_ref_sync().

This happens under the following conditions:

- A pin is registered with two or more dpll devices (dpll_A, dpll_B)

- The pin has ref_sync pairs with other pins

- During unregistration of dpll_A's pins, a ref_sync partner pin is

unregistered first, removing it from dpll_A->pin_refs

- But since the partner pin is still registered with dpll_B, its

dpll_refs is not empty, so dpll_pin_ref_sync_pair_del() does NOT

run and the partner stays in the pin's ref_sync_pins xarray

- When the pin itself is then unregistered from dpll_A, the delete

notification calls dpll_msg_add_pin_ref_sync() which finds the

partner in ref_sync_pins, passes dpll_pin_available() (partner is

still registered with dpll_B), but dpll_pin_on_dpll_priv(dpll_A,

partner) returns NULL because partner was already removed from

dpll_A->pin_refs

- The NULL priv pointer is passed to the driver's ref_sync_get

callback, which dereferences it

BUG: kernel NULL pointer dereference, address: 0000000000000034

Oops: Oops: 0000 [#1] SMP NOPTI

RIP: 0010:zl3073x_dpll_input_pin_ref_sync_get+0x73/0x80 [zl3073x]

Call Trace:

dpll_msg_add_pin_ref_sync+0xb8/0x200

dpll_cmd_pin_get_one+0x3b6/0x4b0

dpll_pin_event_send+0x72/0x140

__dpll_pin_unregister+0x5a/0x2b0

dpll_pin_unregister+0x49/0x70

Fix this by skipping ref_sync pins whose priv pointer cannot be resolved

for the current dpll device.