CVE-2026-23129

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

dpll: Prevent duplicate registrations

Modify the internal registration helpers dpll_xa_ref_{dpll,pin}_add()

to reject duplicate registration attempts.

Previously, if a caller attempted to register the same pin multiple

times (with the same ops, priv, and cookie) on the same device, the core

silently increments the reference count and return success. This behavior

is incorrect because if the caller makes these duplicate registrations

then for the first one dpll_pin_registration is allocated and for others

the associated dpll_pin_ref.refcount is incremented. During the first

unregistration the associated dpll_pin_registration is freed and for

others WARN is fired.

Fix this by updating the logic to return `-EEXIST` if a matching

registration is found to enforce a strict "register once" policy.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References