CVE-2026-68378

UNRATEDCVSS · not yet scoredTrending — 4 sources updated this week
—
EchelonGraph verdictMonitorLow exploitation likelihood right now — keep watching.
  • No CVSS published and no exploitation signals yet
CISA-KEV: Not listedEPSS PROB: 0%CVSS v2: —Exploit: None knownExposed: 0

No vendor fix yet — apply a workaround or compensating control (WAF / firewall / segmentation) and watch for a patch.

In the Linux kernel, the following vulnerability has been resolved:

dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync()

When a dpll_pin is shared across multiple dpll_device instances and those devices are being unregistered (e.g. during driver module removal), a NULL pointer dereference can occur in dpll_msg_add_pin_ref_sync().

This happens under the following conditions:

  • A pin is registered with two or more dpll devices (dpll_A, dpll_B)
  • The pin has ref_sync pairs with other pins
  • During unregistration of dpll_A's pins, a ref_sync partner pin is
unregistered first, removing it from dpll_A->pin_refs
  • But since the partner pin is still registered with dpll_B, its
dpll_refs is not empty, so dpll_pin_ref_sync_pair_del() does NOT run and the partner stays in the pin's ref_sync_pins xarray
  • When the pin itself is then unregistered from dpll_A, the delete
notification calls dpll_msg_add_pin_ref_sync() which finds the partner in ref_sync_pins, passes dpll_pin_available() (partner is still registered with dpll_B), but dpll_pin_on_dpll_priv(dpll_A, partner) returns NULL because partner was already removed from dpll_A->pin_refs
  • The NULL priv pointer is passed to the driver's ref_sync_get
callback, which dereferences it

BUG: kernel NULL pointer dereference, address: 0000000000000034 Oops: Oops: 0000 [#1] SMP NOPTI RIP: 0010:zl3073x_dpll_input_pin_ref_sync_get+0x73/0x80 [zl3073x] Call Trace: dpll_msg_add_pin_ref_sync+0xb8/0x200 dpll_cmd_pin_get_one+0x3b6/0x4b0 dpll_pin_event_send+0x72/0x140 __dpll_pin_unregister+0x5a/0x2b0 dpll_pin_unregister+0x49/0x70

Fix this by skipping ref_sync pins whose priv pointer cannot be resolved for the current dpll device.

CVSS v3
—
EchelonGraph score
Not yet assessedNo source has published severity data for this CVE yet — no CVSS score from NVD or a CNA, no GitHub advisory, and it is not in CISA KEV. This is not a rating of zero; we cannot assess it yet.
EG Score
—
EG Risk
—
EPSS PROB
0%
EPSS %ILE
10%
KEV
Not listed

Published

August 10, 2026

Last Modified

August 17, 2026

References (4)

Vendor Advisories for CVE-2026-68378(1)

These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.

Data Freshness Timeline

(refreshed 13× in last 7d / 19× in last 30d)

Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.

  1. 2026-08-20 01:14 UTCGHSA enrichment
  2. 2026-08-19 17:04 UTCEPSS rescore
  3. 2026-08-18 13:49 UTCEPSS rescore
  4. 2026-08-18 13:49 UTCEPSS rescore
  5. 2026-08-17 13:47 UTCEPSS rescore
  6. 2026-08-17 06:32 UTCGHSA enrichment
  7. 2026-08-17 06:18 UTCNVD update
  8. 2026-08-17 05:36 UTCGHSA enrichment
  9. 2026-08-17 05:24 UTCMITRE cvelistV5
  10. 2026-08-16 14:56 UTCEPSS rescore
  11. 2026-08-16 02:51 UTCGHSA enrichment
  12. 2026-08-15 01:30 UTCEPSS rescore
  13. 2026-08-13 22:00 UTCEPSS rescore
  14. 2026-08-13 08:08 UTCEG score recompute
  15. 2026-08-13 08:08 UTCGHSA enrichment
  16. 2026-08-12 13:51 UTCEPSS rescore
  17. 2026-08-10 13:24 UTCNVD update
  18. 2026-08-10 12:18 UTCEG score recompute
  19. 2026-08-10 12:17 UTCMITRE cvelistV5first tracked

Frequently asked(4)

What is CVE-2026-68378?
CVE-2026-68378 is a publicly disclosed vulnerability published on August 10, 2026. In the Linux kernel, the following vulnerability has been resolved: dpll: fix NULL pointer dereference in dpllmsgaddpinref_sync() When a dpllpin is shared across multiple dplldevice instances and those devices are being unregistered (e.g. during driver module removal), a NULL pointer dereference…
When was CVE-2026-68378 disclosed?
CVE-2026-68378 was first published in the National Vulnerability Database on August 10, 2026, with the most recent update on August 17, 2026. EchelonGraph re-ingests CVE updates from NVD on a 2-hour cycle, so this page reflects the latest published state.
Is CVE-2026-68378 actively exploited?
CVE-2026-68378 is not currently on CISA's Known Exploited Vulnerabilities catalog. FIRST EPSS estimates a 0% probability of exploitation in the next 30 days, which ranks it in the top 89.8% of all scored CVEs.
How do I remediate CVE-2026-68378?
Patch to the fixed version published by the affected vendor. Where vendor advisories exist for CVE-2026-68378, EchelonGraph cross-links them in the Vendor Advisories panel below — those typically contain the canonical remediation steps, fixed version numbers, and any vendor-specific mitigations.

Dependency Blast Radius

Explore the affected products and dependency analysis for CVE-2026-68378

Explore →

Is Your Infrastructure Affected by CVE-2026-68378?

EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.

Start Free Scan →Browse All CVEs