CVE-2026-90144

In the Linux kernel, the following vulnerability has been resolved:

dpll: fix NULL deref in dpll_device_ops() during teardown race

When the last owner of a dpll device unregisters while a foreign driver

still holds a pin on it via dpll_pin_on_pin_register(), the dpll object

stays alive with an empty registration list. A pin notification queued

before the unregister (e.g. ice reacting to zl3073x_i2c removal) then

walks pin->dpll_refs into dpll_device_ops(), which trips the WARN_ON and

dereferences the missing registration. dpll_lock cannot help because the

notification work was queued before the unregistering driver took the

lock.

Treat the empty registration list as a legitimate transient state. Make

dpll_priv() and dpll_device_ops() return NULL in that case and make

every pin netlink path that resolves a device from a pin skip such

dplls. dpll_cmd_pin_get_one() picks a ref with a live registration and

returns -ENODEV when there is none, the pin dumpit skips such a pin

instead of aborting the dump, dpll_msg_add_pin_dplls() and the

frequency, esync, reference sync and phase adjust set paths skip dead

refs, and dpll_pin_parent_device_set() validates the parent with

dpll_device_get_by_id(). dpll_pin_register() is the last caller that

dereferenced the device ops without a check, so move its frequency

monitor validation under dpll_lock and tolerate a missing registration

there as well.

The empty registration list is equivalent to a cleared DPLL_REGISTERED

mark, both transitions happen under dpll_lock in dpll_device_register()

and dpll_device_unregister(). A pin notification for a pin whose dplls

are all gone is now dropped with -ENODEV instead of crashing, all

callers in the core ignore that return value.

WARNING: drivers/dpll/dpll_core.c:1092 at dpll_device_ops+0x24/0x40,

CPU#83: kworker/u576:3/23471

Modules linked in: ... ice ... zl3073x_i2c(-) ... zl3073x ...

Workqueue: ice_dpll_wq ice_dpll_pin_notify_work [ice]

RIP: 0010:dpll_device_ops+0x24/0x40

Call Trace:

<TASK>

dpll_cmd_pin_get_one+0x336/0x520

dpll_pin_event_send+0x82/0x140

dpll_pin_on_pin_unregister+0xbb/0x160

ice_dpll_pin_notify_work+0x1bc/0x1f0 [ice]

process_one_work+0x19e/0x370

worker_thread+0x1a6/0x310

kthread+0xe4/0x120

ret_from_fork+0x1a1/0x270

ret_from_fork_asm+0x1a/0x30

</TASK>

---[ end trace 0000000000000000 ]---

BUG: kernel NULL pointer dereference, address: 0000000000000010

#PF: supervisor read access in kernel mode

#PF: error_code(0x0000) - not-present page