In the Linux kernel, the following vulnerability has been resolved: dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() When a dpll_pin is shared across multiple dpll_device instances and those devices are being unregistered (e.g. during driver module removal), a NULL pointer dereference can occur in dpll_msg_add_pin_ref_sync(). This happens under the following conditions: - A pin is registered with two or more dpll devices (dpll_A, dpll_B) - The pin has ref_sync pairs with other pins - During unregistration of dpll_A's pins, a ref_sync partner pin is unregistered first, removing it from dpll_A->pin_refs - But since the partner pin is still registered with dpll_B, its dpll_refs is not empty, so dpll_pin_ref_sync_pair_del() does NOT run and the partner stays in the pin's ref_sync_pins xarray - When the pin itself is then unregistered from dpll_A, the delete notification calls dpll_msg_add_pin_ref_sync() which finds the partner in ref_sync_pins, passes dpll_pin_available() (partner is still registered with dpll_B), but dpll_pin_on_dpll_priv(dpll_A, partner) returns NULL because partner was already removed from dpll_A->pin_refs - The NULL priv pointer is passed to the driver's ref_sync_get callback, which dereferences it BUG: kernel NULL pointer dereference, address: 0000000000000034 Oops: Oops: 0000 [#1] SMP NOPTI RIP: 0010:zl3073x_dpll_input_pin_ref_sync_get+0x73/0x80 [zl3073x] Call Trace: dpll_msg_add_pin_ref_sync+0xb8/0x200 dpll_cmd_pin_get_one+0x3b6/0x4b0 dpll_pin_event_send+0x72/0x140 __dpll_pin_unregister+0x5a/0x2b0 dpll_pin_unregister+0x49/0x70 Fix this by skipping ref_sync pins whose priv pointer cannot be resolved for the current dpll device.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In the Linux kernel, the following vulnerability has been resolved: dpll: fix NULL pointer dereference in
    dpll_msg_add_pin_ref_sync() When a dpll_pin is shared across multiple dpll_device instances and those
    devices are being unregistered (e.g. during driver module removal), a NULL pointer dereference can occur
    in dpll_msg_add_pin_ref_sync(). This happens under the following conditions: - A pin is registered with
    two or more dpll devices (dpll_A, dpll_B) - The pin has ref_sync pairs with other pins - During
    unregistration of dpll_A's pins, a ref_sync partner pin is unregistered first, removing it from
    dpll_A->pin_refs - But since the partner pin is still registered with dpll_B, its dpll_refs is not empty,
    so dpll_pin_ref_sync_pair_del() does NOT run and the partner stays in the pin's ref_sync_pins xarray -
    When the pin itself is then unregistered from dpll_A, the delete notification calls
    dpll_msg_add_pin_ref_sync() which finds the partner in ref_sync_pins, passes dpll_pin_available() (partner
    is still registered with dpll_B), but dpll_pin_on_dpll_priv(dpll_A, partner) returns NULL because partner
    was already removed from dpll_A->pin_refs - The NULL priv pointer is passed to the driver's ref_sync_get
    callback, which dereferences it BUG: kernel NULL pointer dereference, address: 0000000000000034 Oops:
    Oops: 0000 [#1] SMP NOPTI RIP: 0010:zl3073x_dpll_input_pin_ref_sync_get+0x73/0x80 [zl3073x] Call Trace:
    dpll_msg_add_pin_ref_sync+0xb8/0x200 dpll_cmd_pin_get_one+0x3b6/0x4b0 dpll_pin_event_send+0x72/0x140
    __dpll_pin_unregister+0x5a/0x2b0 dpll_pin_unregister+0x49/0x70 Fix this by skipping ref_sync pins whose
    priv pointer cannot be resolved for the current dpll device. (CVE-2026-68378)

An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: dpll: fix NULL pointer dereference in     dpll_msg_add_pin_ref_sync() When a dpll_pin is shared across multiple dpll_device instances and those     devices are being unregistered (e.g. during driver module removal), a NULL pointer dereference can occur     in dpll_msg_add_pin_ref_sync(). This happens under the following conditions: - A pin is registered with     two or more dpll devices (dpll_A, dpll_B) - The pin has ref_sync pairs with other pins - During     unregistration of dpll_A's pins, a ref_sync partner pin is unregistered first, removing it from     dpll_A->pin_refs - But since the partner pin is still registered with dpll_B, its dpll_refs is not empty,     so dpll_pin_ref_sync_pair_del() does NOT run and the partner stays in the pin's ref_sync_pins xarray -     When the pin itself is then unregistered from dpll_A, the delete notification calls     dpll_msg_add_pin_ref_sync() which finds the partner in ref_sync_pins, passes dpll_pin_available() (partner     is still registered with dpll_B), but dpll_pin_on_dpll_priv(dpll_A, partner) returns NULL because partner     was already removed from dpll_A->pin_refs - The NULL priv pointer is passed to the driver's ref_sync_get     callback, which dereferences it BUG: kernel NULL pointer dereference, address: 0000000000000034 Oops:
    Oops: 0000 [#1] SMP NOPTI RIP: 0010:zl3073x_dpll_input_pin_ref_sync_get+0x73/0x80 [zl3073x] Call Trace:
    dpll_msg_add_pin_ref_sync+0xb8/0x200 dpll_cmd_pin_get_one+0x3b6/0x4b0 dpll_pin_event_send+0x72/0x140
    __dpll_pin_unregister+0x5a/0x2b0 dpll_pin_unregister+0x49/0x70 Fix this by skipping ref_sync pins whose     priv pointer cannot be resolved for the current dpll device. (CVE-2026-68378)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
365768	Ubuntu 26.04 LTS : Linux kernel (Azure) vulnerabilities (USN-8888-1)	Nessus	Ubuntu Local Security Checks	Local	medium
365767	Ubuntu 26.04 LTS : Linux kernel vulnerabilities (USN-8887-1)	Nessus	Ubuntu Local Security Checks	Local	medium
365463	Ubuntu 26.04 LTS : Linux kernel (OEM) vulnerabilities (USN-8889-1)	Nessus	Ubuntu Local Security Checks	Local	medium
470828	Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 20085.0.0	Tenable Cloud Security	Google COS Security Checks	Local	medium
470828	Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 20085.0.0	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	medium
470561	Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.21	Tenable Cloud Security	Google COS Security Checks	Local	medium
470561	Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.21	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	medium
343049	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500248)	Nessus	Oracle Linux Local Security Checks	Local	high
341888	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-2106)	Nessus	Amazon Linux Local Security Checks	Local	high
334784	Photon OS 5.0: Linux PHSA-2026-5.0-92-0952	Nessus	PhotonOS Local Security Checks	Local	high
334739	Linux Distros Unpatched Vulnerability : CVE-2026-68378	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-68378

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

high

high

high

medium