{"id":"CVE-2023-54026","state":"PUBLISHED","title":"opp: Fix use-after-free in lazy_opp_tables after probe deferral","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nopp: Fix use-after-free in lazy_opp_tables after probe deferral\n\nWhen dev_pm_opp_of_find_icc_paths() in _allocate_opp_table() returns\n-EPROBE_DEFER, the opp_table is freed again, to wait until all the\ninterconnect paths are available.\n\nHowever, if the OPP table is using required-opps then it may already\nhave been added to the global lazy_opp_tables list. The error path\ndoes not remove the opp_table from the list again.\n\nThis can cause crashes later when the provider of the required-opps\nis added, since we will iterate over OPP tables that have already been\nfreed. E.g.:\n\n  Unable to handle kernel NULL pointer dereference when read\n  CPU: 0 PID: 7 Comm: kworker/0:0 Not tainted 6.4.0-rc3\n  PC is at _of_add_opp_table_v2 (include/linux/of.h:949\n  drivers/opp/of.c:98 drivers/opp/of.c:344 drivers/opp/of.c:404\n  drivers/opp/of.c:1032) -> lazy_link_required_opp_table()\n\nFix this by calling _of_clear_opp_table() to remove the opp_table from\nthe list and clear other allocated resources. While at it, also add the\nmissing mutex_destroy() calls in the error path.","publishedAt":"2025-12-24T10:55:55.182Z","updatedAt":"2026-08-05T09:16:38.468Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"7eba0c7641b0009818e469dbfcdd87a0155ab9d4","status":"affected","lessThan":"39a0e723d3502f6dc4c603f57ebe8dc7bcc4a4bc","versionType":"git"},{"version":"7eba0c7641b0009818e469dbfcdd87a0155ab9d4","status":"affected","lessThan":"76ab057de777723ec924654502d1a260ba7d7d54","versionType":"git"},{"version":"7eba0c7641b0009818e469dbfcdd87a0155ab9d4","status":"affected","lessThan":"c05e76d6b249e5254c31994eedd06dd3cc90dee0","versionType":"git"},{"version":"7eba0c7641b0009818e469dbfcdd87a0155ab9d4","status":"affected","lessThan":"b2a2ab039bd58f51355e33d7d3fc64605d7f870d","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/opp/core.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.12","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.12","versionType":"semver"},{"version":"5.15.121","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.40","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.4.5","status":"unaffected","lessThanOrEqual":"6.4.*","versionType":"semver"},{"version":"6.5","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/opp/core.c"]}],"references":["https://git.kernel.org/stable/c/39a0e723d3502f6dc4c603f57ebe8dc7bcc4a4bc","https://git.kernel.org/stable/c/76ab057de777723ec924654502d1a260ba7d7d54","https://git.kernel.org/stable/c/c05e76d6b249e5254c31994eedd06dd3cc90dee0","https://git.kernel.org/stable/c/b2a2ab039bd58f51355e33d7d3fc64605d7f870d"],"weaknesses":[],"ingestedAt":"2026-10-29T20:06:42.242Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/54xxx/CVE-2023-54026.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2023-54026","state":"PUBLISHED","datePublished":"2025-12-24T10:55:55.182Z","dateUpdated":"2026-08-05T09:16:38.468Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-12-24T10:53:46.179Z"},"containers":{"cna":{"title":"opp: Fix use-after-free in lazy_opp_tables after probe deferral","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nopp: Fix use-after-free in lazy_opp_tables after probe deferral\n\nWhen dev_pm_opp_of_find_icc_paths() in _allocate_opp_table() returns\n-EPROBE_DEFER, the opp_table is freed again, to wait until all the\ninterconnect paths are available.\n\nHowever, if the OPP table is using required-opps then it may already\nhave been added to the global lazy_opp_tables list. The error path\ndoes not remove the opp_table from the list again.\n\nThis can cause crashes later when the provider of the required-opps\nis added, since we will iterate over OPP tables that have already been\nfreed. E.g.:\n\n  Unable to handle kernel NULL pointer dereference when read\n  CPU: 0 PID: 7 Comm: kworker/0:0 Not tainted 6.4.0-rc3\n  PC is at _of_add_opp_table_v2 (include/linux/of.h:949\n  drivers/opp/of.c:98 drivers/opp/of.c:344 drivers/opp/of.c:404\n  drivers/opp/of.c:1032) -> lazy_link_required_opp_table()\n\nFix this by calling _of_clear_opp_table() to remove the opp_table from\nthe list and clear other allocated resources. While at it, also add the\nmissing mutex_destroy() calls in the error path."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"7eba0c7641b0009818e469dbfcdd87a0155ab9d4","status":"affected","lessThan":"39a0e723d3502f6dc4c603f57ebe8dc7bcc4a4bc","versionType":"git"},{"version":"7eba0c7641b0009818e469dbfcdd87a0155ab9d4","status":"affected","lessThan":"76ab057de777723ec924654502d1a260ba7d7d54","versionType":"git"},{"version":"7eba0c7641b0009818e469dbfcdd87a0155ab9d4","status":"affected","lessThan":"c05e76d6b249e5254c31994eedd06dd3cc90dee0","versionType":"git"},{"version":"7eba0c7641b0009818e469dbfcdd87a0155ab9d4","status":"affected","lessThan":"b2a2ab039bd58f51355e33d7d3fc64605d7f870d","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/opp/core.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.12","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.12","versionType":"semver"},{"version":"5.15.121","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.40","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.4.5","status":"unaffected","lessThanOrEqual":"6.4.*","versionType":"semver"},{"version":"6.5","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/opp/core.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/39a0e723d3502f6dc4c603f57ebe8dc7bcc4a4bc"},{"url":"https://git.kernel.org/stable/c/76ab057de777723ec924654502d1a260ba7d7d54"},{"url":"https://git.kernel.org/stable/c/c05e76d6b249e5254c31994eedd06dd3cc90dee0"},{"url":"https://git.kernel.org/stable/c/b2a2ab039bd58f51355e33d7d3fc64605d7f870d"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable path lies entirely in the OPP core's device-probe code (`_allocate_opp_table()`), reached only through in-kernel driver probe/bind on the local system; there is no network, adjacent-network, or physical-device data path into it.\nAC:L - On an affected DT platform the combination of a lazy `required-opps` link plus an interconnect `-EPROBE_DEFER` occurs deterministically during probe ordering, and the dangling list entry is then consumed unconditionally by the next `lazy_link_required_opp_table()` walk — no race must be won and no unpredictable memory layout is required to reach the freed object.\nPR:L - No authentication or capability check exists in the OPP core path itself; the free-and-dangle happens in driver probe context, so a local low-privileged presence on the system is the most severity-favorable reading (the code performs no privilege validation of its own).\nUI:N - The dangling `lazy_opp_tables` entry is created and later dereferenced automatically as drivers probe and defer; no victim action such as opening a file or mounting a filesystem is needed.\nS:U - The corruption is confined to kernel heap objects owned by the OPP framework within the same kernel security authority — there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - `lazy_link_required_opp_table()` reads a freed `struct opp_table` — `np`, `required_opp_count`, `required_opp_tables[]`, `opp_list` — and follows those stale pointers, so reallocated slab contents can be read and leveraged for kernel memory disclosure, matching the UAF=High guidance.\nI:H - The same walk writes into the freed object: `required_opp_tables[i] = new_table`, the `set_required_opps` function-pointer field via `_update_set_required_opps()`, and a `list_del_init()` unlink through stale prev/next pointers — a classic write-what-where primitive plus function-pointer overwrite usable for control-flow hijack.\nA:H - The bug was reported as a kernel NULL-pointer dereference oops in `_of_add_opp_table_v2()`/`lazy_link_required_opp_table()` during boot, and any traversal of the freed table can panic the kernel or corrupt the global list."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T09:16:38.468Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.12","versionEndExcluding":"5.15.121"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.12","versionEndExcluding":"6.1.40"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.12","versionEndExcluding":"6.4.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.12","versionEndExcluding":"6.5"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}