CVE-2026-63977 (GCVE-0-2026-63977)

Vulnerability from cvelistv5 – Published: 2026-07-19 14:56 – Updated: 2026-08-05 12:37
VLAI
Title
dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work
Summary
In the Linux kernel, the following vulnerability has been resolved: dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work The change_work was introduced to send device change notifications from DPLL device callbacks without deadlocking on dpll_lock, since the callbacks are already invoked under that lock. Now that __dpll_device_change_ntf() is exported for callers that already hold dpll_lock, use it directly and remove the change_work infrastructure entirely. This eliminates a race condition where change_work could be re-scheduled after cancel_work_sync() during device teardown, potentially causing the handler to dereference a freed or NULL dpll_dev pointer.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
Linux CNA under the mitre root
CNA scorecard D 54/100 over 6619 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 9363b4837659d1b7ee04cfa714373ce4b4b8269f , < e7a33807fb3f87a855993474ac21684ce105927b (git)
Affected: 9363b4837659d1b7ee04cfa714373ce4b4b8269f , < d733f519f6443540f8359461a34e3b0042099bbe (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.18
Unaffected: 0 , < 6.18 (semver)
Unaffected: 7.0.12 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/dpll/zl3073x/dpll.c",
            "drivers/dpll/zl3073x/dpll.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e7a33807fb3f87a855993474ac21684ce105927b",
              "status": "affected",
              "version": "9363b4837659d1b7ee04cfa714373ce4b4b8269f",
              "versionType": "git"
            },
            {
              "lessThan": "d733f519f6443540f8359461a34e3b0042099bbe",
              "status": "affected",
              "version": "9363b4837659d1b7ee04cfa714373ce4b4b8269f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/dpll/zl3073x/dpll.c",
            "drivers/dpll/zl3073x/dpll.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "lessThan": "6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndpll: zl3073x: use __dpll_device_change_ntf() and remove change_work\n\nThe change_work was introduced to send device change notifications\nfrom DPLL device callbacks without deadlocking on dpll_lock, since\nthe callbacks are already invoked under that lock. Now that\n__dpll_device_change_ntf() is exported for callers that already\nhold dpll_lock, use it directly and remove the change_work\ninfrastructure entirely.\n\nThis eliminates a race condition where change_work could be\nre-scheduled after cancel_work_sync() during device teardown,\npotentially causing the handler to dereference a freed or NULL\ndpll_dev pointer."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through the DPLL generic-netlink interface (`DPLL_CMD_DEVICE_SET` with `DPLL_A_PHASE_OFFSET_AVG_FACTOR`), which requires a local `sendmsg()`/netlink syscall. The zl3073x driver is an on-board I2C/SPI timing chip driver and is not exposed via remote network packet handling.\nAC:L - Exploitation is a use-after-free race where the attacker controls the scheduling side by repeatedly issuing concurrent DPLL netlink SET requests (`parallel_ops` is enabled). The teardown window is created during sibling-DPLL unregistration in `zl3073x_dev_stop()`, which occurs on driver remove/reboot/maintenance that the attacker can time against.\nPR:L - All DPLL netlink operations are gated by `GENL_ADMIN_PERM`, which requires `CAP_NET_ADMIN`. That capability is obtainable by an unprivileged user via user namespaces (`unshare -Urn`), and the DPLL family is `netnsok`, so this is not restricted to real init-namespace root.\nUI:N - Triggering the race requires only automated netlink traffic from the attacker; no victim user action such as opening a file or mounting a filesystem is needed.\nS:U - Impact is kernel memory corruption and potential privilege escalation within the same kernel security authority. This is not a VM/guest escape or IOMMU boundary bypass.\nC:H - The race leaves a deferred work item that calls `dpll_device_change_ntf()` on a `dpll_dev` pointer that may already be freed, causing a classic use-after-free with reads of freed `struct dpll_device` fields (`id`, `clock_id`, `type`, etc.).\nI:H - Use-after-free of a heap-allocated `struct dpll_device` can be leveraged for controlled reuse and arbitrary kernel memory corruption, including potential control-flow hijacking, not merely a benign crash.\nA:H - Dereferencing a freed or NULL `dpll_dev` from the workqueue handler can cause a kernel oops/panic during device teardown, and UAF conditions inherently threaten system availability even when full exploitation is not attempted."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:37:48.157Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e7a33807fb3f87a855993474ac21684ce105927b"
        },
        {
          "url": "https://git.kernel.org/stable/c/d733f519f6443540f8359461a34e3b0042099bbe"
        }
      ],
      "title": "dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63977",
    "datePublished": "2026-07-19T14:56:01.889Z",
    "dateReserved": "2026-07-19T07:54:57.024Z",
    "dateUpdated": "2026-08-05T12:37:48.157Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-63977",
      "date": "2026-10-11",
      "epss": "0.00165",
      "percentile": "0.05237"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/dpll/zl3073x/dpll.c",
                  "drivers/dpll/zl3073x/dpll.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "e7a33807fb3f87a855993474ac21684ce105927b",
                    "status": "affected",
                    "version": "9363b4837659d1b7ee04cfa714373ce4b4b8269f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d733f519f6443540f8359461a34e3b0042099bbe",
                    "status": "affected",
                    "version": "9363b4837659d1b7ee04cfa714373ce4b4b8269f",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/dpll/zl3073x/dpll.c",
                  "drivers/dpll/zl3073x/dpll.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.18"
                  },
                  {
                    "lessThan": "6.18",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.*",
                    "status": "unaffected",
                    "version": "7.0.12",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndpll: zl3073x: use __dpll_device_change_ntf() and remove change_work\n\nThe change_work was introduced to send device change notifications\nfrom DPLL device callbacks without deadlocking on dpll_lock, since\nthe callbacks are already invoked under that lock. Now that\n__dpll_device_change_ntf() is exported for callers that already\nhold dpll_lock, use it directly and remove the change_work\ninfrastructure entirely.\n\nThis eliminates a race condition where change_work could be\nre-scheduled after cancel_work_sync() during device teardown,\npotentially causing the handler to dereference a freed or NULL\ndpll_dev pointer."
          }
        ],
        "id": "CVE-2026-63977",
        "lastModified": "2026-07-30T14:51:11.223",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-07-19T16:17:16.860",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d733f519f6443540f8359461a34e3b0042099bbe"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e7a33807fb3f87a855993474ac21684ce105927b"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Awaiting Analysis"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-22T07:06:01+00:00",
      "cve": "CVE-2026-63977",
      "id": "CVE-2026-63977",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63977.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-10-01T00:46:55Z",
      "cve": "CVE-2026-63977",
      "id": "CVE-2026-63977",
      "initial_release_date": "2026-07-21T13:02:20Z",
      "product_status:known_not_affected": "376",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-63977",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-63977.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.