CVE-2026-68378

A flaw was found in the Linux kernel's dpll subsystem. A local user could trigger a null pointer dereference in the dpll_msg_add_pin_ref_sync() function when a dpll_pin is shared across multiple dpll_device instances and those devices are being unregistered. This vulnerability can lead to a system crash, resulting in a Denial of Service (DoS).

This issue affects the kernel DPLL (Deterministic PLL) subsystem. When shared dpll_pin objects are unregistered across multiple devices, dpll_msg_add_pin_ref_sync() can NULL-deref during module removal. Systems not using DPLL hardware are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.