CVE-2026-63977

A flaw was found in the Linux kernel's dpll: zl3073x module. A race condition can occur during device teardown when a change_work operation is re-scheduled after a cancel_work_sync() call. This can lead to the system attempting to access a memory location that has been freed or is invalid, potentially causing a system crash and resulting in a denial of service.

This flaw is rated as Moderate impact because triggering it requires local access and the presence of specialized ZL3073x DPLL hardware, limiting the blast radius to a system crash without compromising confidentiality or integrity. In standard Red Hat Enterprise Linux environments, the driver is only active when dedicated hardware is installed, and the underlying race occurs exclusively during device teardown or unbinding procedures.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.