GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-54026 (GCVE-0-2023-54026)

Vulnerability from cvelistv5 – Published: 2025-12-24 10:55 – Updated: 2026-08-05 09:16
VLAI
Title
opp: Fix use-after-free in lazy_opp_tables after probe deferral
Summary
In the Linux kernel, the following vulnerability has been resolved: opp: Fix use-after-free in lazy_opp_tables after probe deferral When dev_pm_opp_of_find_icc_paths() in _allocate_opp_table() returns -EPROBE_DEFER, the opp_table is freed again, to wait until all the interconnect paths are available. However, if the OPP table is using required-opps then it may already have been added to the global lazy_opp_tables list. The error path does not remove the opp_table from the list again. This can cause crashes later when the provider of the required-opps is added, since we will iterate over OPP tables that have already been freed. E.g.: Unable to handle kernel NULL pointer dereference when read CPU: 0 PID: 7 Comm: kworker/0:0 Not tainted 6.4.0-rc3 PC is at _of_add_opp_table_v2 (include/linux/of.h:949 drivers/opp/of.c:98 drivers/opp/of.c:344 drivers/opp/of.c:404 drivers/opp/of.c:1032) -> lazy_link_required_opp_table() Fix this by calling _of_clear_opp_table() to remove the opp_table from the list and clear other allocated resources. While at it, also add the missing mutex_destroy() calls in the error path.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 7eba0c7641b0009818e469dbfcdd87a0155ab9d4 , < 39a0e723d3502f6dc4c603f57ebe8dc7bcc4a4bc (git)
Affected: 7eba0c7641b0009818e469dbfcdd87a0155ab9d4 , < 76ab057de777723ec924654502d1a260ba7d7d54 (git)
Affected: 7eba0c7641b0009818e469dbfcdd87a0155ab9d4 , < c05e76d6b249e5254c31994eedd06dd3cc90dee0 (git)
Affected: 7eba0c7641b0009818e469dbfcdd87a0155ab9d4 , < b2a2ab039bd58f51355e33d7d3fc64605d7f870d (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.12
Unaffected: 0 , < 5.12 (semver)
Unaffected: 5.15.121 , ≤ 5.15.* (semver)
Unaffected: 6.1.40 , ≤ 6.1.* (semver)
Unaffected: 6.4.5 , ≤ 6.4.* (semver)
Unaffected: 6.5 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/opp/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "39a0e723d3502f6dc4c603f57ebe8dc7bcc4a4bc",
              "status": "affected",
              "version": "7eba0c7641b0009818e469dbfcdd87a0155ab9d4",
              "versionType": "git"
            },
            {
              "lessThan": "76ab057de777723ec924654502d1a260ba7d7d54",
              "status": "affected",
              "version": "7eba0c7641b0009818e469dbfcdd87a0155ab9d4",
              "versionType": "git"
            },
            {
              "lessThan": "c05e76d6b249e5254c31994eedd06dd3cc90dee0",
              "status": "affected",
              "version": "7eba0c7641b0009818e469dbfcdd87a0155ab9d4",
              "versionType": "git"
            },
            {
              "lessThan": "b2a2ab039bd58f51355e33d7d3fc64605d7f870d",
              "status": "affected",
              "version": "7eba0c7641b0009818e469dbfcdd87a0155ab9d4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/opp/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.12"
            },
            {
              "lessThan": "5.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.121",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.4.*",
              "status": "unaffected",
              "version": "6.4.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.5",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.121",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.40",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.5",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nopp: Fix use-after-free in lazy_opp_tables after probe deferral\n\nWhen dev_pm_opp_of_find_icc_paths() in _allocate_opp_table() returns\n-EPROBE_DEFER, the opp_table is freed again, to wait until all the\ninterconnect paths are available.\n\nHowever, if the OPP table is using required-opps then it may already\nhave been added to the global lazy_opp_tables list. The error path\ndoes not remove the opp_table from the list again.\n\nThis can cause crashes later when the provider of the required-opps\nis added, since we will iterate over OPP tables that have already been\nfreed. E.g.:\n\n  Unable to handle kernel NULL pointer dereference when read\n  CPU: 0 PID: 7 Comm: kworker/0:0 Not tainted 6.4.0-rc3\n  PC is at _of_add_opp_table_v2 (include/linux/of.h:949\n  drivers/opp/of.c:98 drivers/opp/of.c:344 drivers/opp/of.c:404\n  drivers/opp/of.c:1032) -\u003e lazy_link_required_opp_table()\n\nFix this by calling _of_clear_opp_table() to remove the opp_table from\nthe list and clear other allocated resources. While at it, also add the\nmissing mutex_destroy() calls in the error path."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path lies entirely in the OPP core\u0027s device-probe code (`_allocate_opp_table()`), reached only through in-kernel driver probe/bind on the local system; there is no network, adjacent-network, or physical-device data path into it.\nAC:L - On an affected DT platform the combination of a lazy `required-opps` link plus an interconnect `-EPROBE_DEFER` occurs deterministically during probe ordering, and the dangling list entry is then consumed unconditionally by the next `lazy_link_required_opp_table()` walk \u2014 no race must be won and no unpredictable memory layout is required to reach the freed object.\nPR:L - No authentication or capability check exists in the OPP core path itself; the free-and-dangle happens in driver probe context, so a local low-privileged presence on the system is the most severity-favorable reading (the code performs no privilege validation of its own).\nUI:N - The dangling `lazy_opp_tables` entry is created and later dereferenced automatically as drivers probe and defer; no victim action such as opening a file or mounting a filesystem is needed.\nS:U - The corruption is confined to kernel heap objects owned by the OPP framework within the same kernel security authority \u2014 there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - `lazy_link_required_opp_table()` reads a freed `struct opp_table` \u2014 `np`, `required_opp_count`, `required_opp_tables[]`, `opp_list` \u2014 and follows those stale pointers, so reallocated slab contents can be read and leveraged for kernel memory disclosure, matching the UAF=High guidance.\nI:H - The same walk writes into the freed object: `required_opp_tables[i] = new_table`, the `set_required_opps` function-pointer field via `_update_set_required_opps()`, and a `list_del_init()` unlink through stale prev/next pointers \u2014 a classic write-what-where primitive plus function-pointer overwrite usable for control-flow hijack.\nA:H - The bug was reported as a kernel NULL-pointer dereference oops in `_of_add_opp_table_v2()`/`lazy_link_required_opp_table()` during boot, and any traversal of the freed table can panic the kernel or corrupt the global list."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:16:38.468Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/39a0e723d3502f6dc4c603f57ebe8dc7bcc4a4bc"
        },
        {
          "url": "https://git.kernel.org/stable/c/76ab057de777723ec924654502d1a260ba7d7d54"
        },
        {
          "url": "https://git.kernel.org/stable/c/c05e76d6b249e5254c31994eedd06dd3cc90dee0"
        },
        {
          "url": "https://git.kernel.org/stable/c/b2a2ab039bd58f51355e33d7d3fc64605d7f870d"
        }
      ],
      "title": "opp: Fix use-after-free in lazy_opp_tables after probe deferral",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-54026",
    "datePublished": "2025-12-24T10:55:55.182Z",
    "dateReserved": "2025-12-24T10:53:46.179Z",
    "dateUpdated": "2026-08-05T09:16:38.468Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-54026",
      "date": "2026-09-16",
      "epss": "0.00136",
      "percentile": "0.03387"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-54026\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-24T11:15:55.610\",\"lastModified\":\"2026-08-04T10:19:25.753\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nopp: Fix use-after-free in lazy_opp_tables after probe deferral\\n\\nWhen dev_pm_opp_of_find_icc_paths() in _allocate_opp_table() returns\\n-EPROBE_DEFER, the opp_table is freed again, to wait until all the\\ninterconnect paths are available.\\n\\nHowever, if the OPP table is using required-opps then it may already\\nhave been added to the global lazy_opp_tables list. The error path\\ndoes not remove the opp_table from the list again.\\n\\nThis can cause crashes later when the provider of the required-opps\\nis added, since we will iterate over OPP tables that have already been\\nfreed. E.g.:\\n\\n  Unable to handle kernel NULL pointer dereference when read\\n  CPU: 0 PID: 7 Comm: kworker/0:0 Not tainted 6.4.0-rc3\\n  PC is at _of_add_opp_table_v2 (include/linux/of.h:949\\n  drivers/opp/of.c:98 drivers/opp/of.c:344 drivers/opp/of.c:404\\n  drivers/opp/of.c:1032) -\u003e lazy_link_required_opp_table()\\n\\nFix this by calling _of_clear_opp_table() to remove the opp_table from\\nthe list and clear other allocated resources. While at it, also add the\\nmissing mutex_destroy() calls in the error path.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/opp/core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7eba0c7641b0009818e469dbfcdd87a0155ab9d4\",\"lessThan\":\"39a0e723d3502f6dc4c603f57ebe8dc7bcc4a4bc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7eba0c7641b0009818e469dbfcdd87a0155ab9d4\",\"lessThan\":\"76ab057de777723ec924654502d1a260ba7d7d54\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7eba0c7641b0009818e469dbfcdd87a0155ab9d4\",\"lessThan\":\"c05e76d6b249e5254c31994eedd06dd3cc90dee0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7eba0c7641b0009818e469dbfcdd87a0155ab9d4\",\"lessThan\":\"b2a2ab039bd58f51355e33d7d3fc64605d7f870d\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/opp/core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.121\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.40\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.4.5\",\"lessThanOrEqual\":\"6.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.5\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/39a0e723d3502f6dc4c603f57ebe8dc7bcc4a4bc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/76ab057de777723ec924654502d1a260ba7d7d54\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b2a2ab039bd58f51355e33d7d3fc64605d7f870d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c05e76d6b249e5254c31994eedd06dd3cc90dee0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:52:29+00:00",
      "cve": "CVE-2023-54026",
      "id": "CVE-2023-54026",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:fixed": "279",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "166",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: opp: Fix use-after-free in lazy_opp_tables after probe deferral",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-54026.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T02:09:29Z",
      "cve": "CVE-2023-54026",
      "id": "CVE-2023-54026",
      "initial_release_date": "2025-12-25T00:57:23Z",
      "product_status:known_affected": "354",
      "product_status:known_not_affected": "231",
      "product_status:recommended": "455",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-54026",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-54026.json",
      "version": "35"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.