{
  "cveId": "CVE-2026-90144",
  "url": "https://patchblox.com/security/cve/CVE-2026-90144",
  "summary": "CVE-2026-90144 is fixed in linux on 1 platform, first by DEBIAN-CVE-2026-90144, released September 23, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "dpll: fix NULL deref in dpll_device_ops() during teardown race",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  dpll: fix NULL deref in dpll_device_ops() during teardown race  When the last owner of a dpll device unregisters while a foreign driver still holds a pin on it via dpll_pin_on_pin_register(), the dpll object stays alive with an empty registration list. A pin notification queued before the unregister (e.g. ice reacting to zl3073x_i2c removal) then walks pin-\u003Edpll_refs into dpll_device_ops(), which trips the WARN_ON and dereferences the missing registration. dpll_lock cannot help because the notification work was queued before the unregistering driver took the lock.  Treat the empty registration list as a legitimate transient state. Make dpll_priv() and dpll_device_ops() return NULL in that case and make every pin netlink path that resolves a device from a pin skip such dplls. dpll_cmd_pin_get_one() picks a ref with a live registration and returns -ENODEV when there is none, the pin dumpit skips such a pin instead of aborting the dump, dpll_msg_add_pin_dplls() and the frequency, esync, reference sync and phase adjust set paths skip dead refs, and dpll_pin_parent_device_set() validates the parent with dpll_device_get_by_id(). dpll_pin_register() is the last caller that dereferenced the device ops without a check, so move its frequency monitor validation under dpll_lock and tolerate a missing registration there as well.  The empty registration list is equivalent to a cleared DPLL_REGISTERED mark, both transitions happen under dpll_lock in dpll_device_register() and dpll_device_unregister(). A pin notification for a pin whose dplls are all gone is now dropped with -ENODEV instead of crashing, all callers in the core ignore that return value.   WARNING: drivers/dpll/dpll_core.c:1092 at dpll_device_ops\u002B0x24/0x40,  CPU#83: kworker/u576:3/23471  Modules linked in: ... ice ... zl3073x_i2c(-) ... zl3073x ...  Workqueue: ice_dpll_wq ice_dpll_pin_notify_work [ice]  RIP: 0010:dpll_device_ops\u002B0x24/0x40  Call Trace:   \u003CTASK\u003E   dpll_cmd_pin_get_one\u002B0x336/0x520   dpll_pin_event_send\u002B0x82/0x140   dpll_pin_on_pin_unregister\u002B0xbb/0x160   ice_dpll_pin_notify_work\u002B0x1bc/0x1f0 [ice]   process_one_work\u002B0x19e/0x370   worker_thread\u002B0x1a6/0x310   kthread\u002B0xe4/0x120   ret_from_fork\u002B0x1a1/0x270   ret_from_fork_asm\u002B0x1a/0x30   \u003C/TASK\u003E  ---[ end trace 0000000000000000 ]---  BUG: kernel NULL pointer dereference, address: 0000000000000010  #PF: supervisor read access in kernel mode  #PF: error_code(0x0000) - not-present page",
  "published": "2026-09-17T17:17:07Z",
  "severity": "",
  "epss": 0.00209,
  "epssPercentile": 0.11083,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-90144",
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.12.115-2",
      "fix": "DEBIAN-CVE-2026-90144",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-90144",
      "released": "2026-09-23T19:19:02Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.2.6-1",
      "fix": "DEBIAN-CVE-2026-90144",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-90144",
      "released": "2026-09-23T19:19:02Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}