CVE-2026-74405

OPP: Fix race between OPP addition and lookup

State: Published
Severity: 7.8 High
Published: Aug 15, 2026
Updated: Oct 30, 2026
Reserved: Aug 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

OPP: Fix race between OPP addition and lookup

A race exists between dev_pm_opp_add_dynamic() and dev_pm_opp_find_freq_exact():

CPU0 (add) CPU1 (lookup) ------------------------------- ------------------------------ _opp_add() mutex_lock() list_add(&new_opp->node, head) mutex_unlock() _opp_table_find_key() mutex_lock() dev_pm_opp_get(opp) kref_get() mutex_unlock() kref_init(&new_opp->kref) dev_pm_opp_put() kref_put_mutex()

The newly added OPP is inserted into the list before its kref is initialized. A concurrent lookup can find this OPP and increment its reference count while it is still uninitialized, leading to refcount corruption and a potential premature free.

Fix this by initializing ->kref and ->opp_table before making the OPP visible via list_add(). This ensures any concurrent lookup observes a fully initialized object.

[ Viresh: Updated commit log ]

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	7034764a1e4a6edbb60914e89aad8384e3fe5d17 to before 835b9b5b4d287a03c713680b0231d36ff599201bAffected 7034764a1e4a6edbb60914e89aad8384e3fe5d17 to before 2fb061a90898420d8ca1a0b9959ca977d90fa841Affected 7034764a1e4a6edbb60914e89aad8384e3fe5d17 to before e25be5d812ec8ca2615d23726b3861b04e2fff35Affected 7034764a1e4a6edbb60914e89aad8384e3fe5d17 to before 932ebfad767be1395946cbc1727a7c38eeee3d24Affected 7034764a1e4a6edbb60914e89aad8384e3fe5d17 to before 1946ea2f6b3ec00e313c78e83fc196f1f6aba2a9Affected 7034764a1e4a6edbb60914e89aad8384e3fe5d17 to before 46696b0b2123475d7f95909435c09808fc5ffd23Affected 7034764a1e4a6edbb60914e89aad8384e3fe5d17 to before bb75bd7d9ae7672034f73ce67a57e6ac89bb39e5Affected 7034764a1e4a6edbb60914e89aad8384e3fe5d17 to before f5e1cc9a284bff2510981643a5bca4bc4c21b81aAffected
LinuxLinux	4.11Affected before 4.11Not affected 5.10.273 through 5.10.Not affected 5.15.224 through 5.15.Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.114 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

7034764a1e4a6edbb60914e89aad8384e3fe5d17 to before 835b9b5b4d287a03c713680b0231d36ff599201bAffected
7034764a1e4a6edbb60914e89aad8384e3fe5d17 to before 2fb061a90898420d8ca1a0b9959ca977d90fa841Affected
7034764a1e4a6edbb60914e89aad8384e3fe5d17 to before e25be5d812ec8ca2615d23726b3861b04e2fff35Affected
7034764a1e4a6edbb60914e89aad8384e3fe5d17 to before 932ebfad767be1395946cbc1727a7c38eeee3d24Affected
7034764a1e4a6edbb60914e89aad8384e3fe5d17 to before 1946ea2f6b3ec00e313c78e83fc196f1f6aba2a9Affected
7034764a1e4a6edbb60914e89aad8384e3fe5d17 to before 46696b0b2123475d7f95909435c09808fc5ffd23Affected
7034764a1e4a6edbb60914e89aad8384e3fe5d17 to before bb75bd7d9ae7672034f73ce67a57e6ac89bb39e5Affected
7034764a1e4a6edbb60914e89aad8384e3fe5d17 to before f5e1cc9a284bff2510981643a5bca4bc4c21b81aAffected

LinuxLinux

4.11Affected
before 4.11Not affected
5.10.273 through 5.10.*Not affected
5.15.224 through 5.15.*Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.114 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.