CVE-2026-23129
Duplicate Registration Vulnerability in Linux Kernel DPLL Component
Publication date: 2026-02-14
Last updated on: 2026-03-18
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | From 6.7 (inc) to 6.12.68 (exc) |
| linux | linux_kernel | From 6.13 (inc) to 6.18.8 (exc) |
| linux | linux_kernel | 6.19 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's dpll component, where duplicate registrations of the same pin on the same device were allowed. Previously, if a caller tried to register the same pin multiple times with identical parameters, the system would silently increment a reference count and return success, even though this behavior was incorrect.
The problem was that the first registration allocated a dpll_pin_registration, but subsequent duplicate registrations only incremented a reference count. When the first unregistration occurred, the allocated registration was freed, causing warnings for the remaining references.
The fix enforces a strict "register once" policy by modifying the registration helpers to reject duplicate registration attempts and return an error code (-EEXIST) if a matching registration is found.
How can this vulnerability impact me? :
This vulnerability can lead to incorrect reference counting in the Linux kernel's dpll pin registration system. As a result, it may cause warnings or errors during unregistration, potentially leading to instability or unexpected behavior in the kernel's device management.
While the description does not specify direct security impacts such as privilege escalation or denial of service, the improper handling of duplicate registrations could affect system reliability or debugging processes.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is fixed by modifying the internal registration helpers to reject duplicate registration attempts, returning an error if a duplicate is found. To mitigate this vulnerability, you should update your Linux kernel to a version that includes this fix.