CVE-2026-63977
Received Received - Intake

Race Condition in Linux Kernel DPLL ZL3073X Driver

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work The change_work was introduced to send device change notifications from DPLL device callbacks without deadlocking on dpll_lock, since the callbacks are already invoked under that lock. Now that __dpll_device_change_ntf() is exported for callers that already hold dpll_lock, use it directly and remove the change_work infrastructure entirely. This eliminates a race condition where change_work could be re-scheduled after cancel_work_sync() during device teardown, potentially causing the handler to dereference a freed or NULL dpll_dev pointer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63977
EUVD
EUVD-2026-45750

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a race condition in the DPLL (Digital Phase-Locked Loop) subsystem. Specifically, it affects the zl3073x driver where a work queue mechanism (change_work) was used to send device change notifications without causing deadlocks. The fix removes this work queue and uses a direct function call instead, eliminating a scenario where the work queue could be incorrectly rescheduled during device teardown, leading to potential use of a freed or NULL pointer.

Detection Guidance

This vulnerability is specific to the Linux kernel's DPLL (Deterministic Packet Lossless) subsystem, particularly the zl3073x driver. Detection requires checking kernel logs for related errors or kernel panics involving the DPLL or zl3073x components. Commands like dmesg | grep -i dpll or journalctl -k | grep -i dpll may help identify issues.

Impact Analysis

If exploited, this vulnerability could cause system instability or crashes in systems running affected Linux kernel versions. It may lead to kernel panics or unexpected behavior in systems using the zl3073x DPLL device. However, exploitation requires specific conditions and is not a remote attack vector.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a Linux kernel race condition in DPLL device handling. No evidence suggests data exposure, privacy violations, or security control failures that would impact regulatory compliance.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for CVE-2026-63977. This vulnerability is specific to the DPLL device handling in the kernel, so applying the official kernel patch is the primary mitigation step.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63977. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart