Executive brief
The Linux kernel's operating performance points (OPP) subsystem manages CPU and device power states. A bug in memory cleanup ordering can cause a crash when the system frees certain kernel structures in the wrong sequence, potentially leading to system instability or denial of service.
Technical details
A use-after-free vulnerability exists in the OPP (Operating Performance Points) subsystem in drivers/opp/core.c. The issue stems from incorrect initialization order of scope-based pointers introduced in commit 173e02d67494, which caused *opp_table to be initialized after *opp. This reversed the order of registered cleanup functions; when the last reference is released, the _opp_kref_release function attempts to access opp->opp_table after it has already been freed. The vulnerability requires no authentication or special privileges, affecting any code path that calls dev_pm_opp_set_rate(), _opp_set_availability(), or dev_pm_opp_adjust_voltage(). The fix reorders the pointer initialization to restore the correct cleanup sequence, with patches available in the stable kernel tree.
Affected products
- Linux Linux kernel multiple versions (see upstream fix commit 173e02d67494)
Timeline
- 2026-09-17: disclosed: CVE-2026-93069 published
- 2026-07-15: patched: Upstream fix commit ce46fede7792cedd247e34b48bc8a02eb90c7848