CVE-2026-63977 dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work
A race condition in the Linux kernel DPLL driver could cause a null pointer dereference during device teardown, leading to a system crash.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-63977?
CVE-2026-63977 is a high-severity vulnerability in Linux, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work
The change_work was introduced to send device change notifications from DPLL device callbacks without deadlocking on dpll_lock, since the callbacks are already invoked under that lock. Now that __dpll_device_change_ntf() is exported for callers that already hold dpll_lock, use it directly and remove the change_work infrastructure entirely.
This eliminates a race condition where change_work could be re-scheduled after cancel_work_sync() during device teardown, potentially causing the handler to dereference a freed or NULL dpll_dev pointer.
Weakness: CWE-362
Which versions are affected by CVE-2026-63977?
How do I fix CVE-2026-63977?
Apply the vendor's patch.
Is CVE-2026-63977 being exploited?
There is no known exploitation of CVE-2026-63977 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-63977, DEBIAN-CVE-2026-63977, GHSA-665c-mwm9-rw7p, UBUNTU-CVE-2026-63977.