Linux Kernel CVE-2026-63977

Vendor-released patch: upgrade to Linux stable 7.0.12 or 7.1 (or later), which contain the fix commits d733f519f6443540f8359461a34e3b0042099bbe and e7a33807fb3f87a855993474ac21684ce105927b that replace the change_work infrastructure with the lock-safe __dpll_device_change_ntf() call; distribution kernels should be updated to the vendor build incorporating these commits. If immediate patching is not possible, the practical compensating control is to avoid loading the zl3073x driver on systems that do not require it (blacklist the module via modprobe), which removes the vulnerable code path entirely at the cost of disabling DPLL/clock-sync functionality for that hardware. Restrict local shell and administrative access on affected timing appliances to limit who can trigger DPLL device teardown/hotplug events. Apply the upstream commits directly if maintaining a custom kernel. Advisory and commit URLs: https://git.kernel.org/stable/c/e7a33807fb3f87a855993474ac21684ce105927b and https://git.kernel.org/stable/c/d733f519f6443540f8359461a34e3b0042099bbe.