CVE-2023-54026
- Source
- https://cve.org/CVERecord?id=CVE-2023-54026
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-54026.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2023-54026
- Downstream
- Published
- 2025-12-24T10:55:55.182Z
- Modified
- 2025-12-29T11:53:51.740198Z
- Summary
- opp: Fix use-after-free in lazy_opp_tables after probe deferral
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
opp: Fix use-after-free in lazyopptables after probe deferral
When devpmoppoffindiccpaths() in allocateopptable() returns -EPROBEDEFER, the opp_table is freed again, to wait until all the interconnect paths are available.
However, if the OPP table is using required-opps then it may already have been added to the global lazyopptables list. The error path does not remove the opp_table from the list again.
This can cause crashes later when the provider of the required-opps is added, since we will iterate over OPP tables that have already been freed. E.g.:
Unable to handle kernel NULL pointer dereference when read CPU: 0 PID: 7 Comm: kworker/0:0 Not tainted 6.4.0-rc3 PC is at ofaddopptablev2 (include/linux/of.h:949 drivers/opp/of.c:98 drivers/opp/of.c:344 drivers/opp/of.c:404 drivers/opp/of.c:1032) -> lazylinkrequiredopp_table()
Fix this by calling ofclearopptable() to remove the opptable from the list and clear other allocated resources. While at it, also add the missing mutexdestroy() calls in the error path.
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/54xxx/CVE-2023-54026.json" }- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/39a0e723d3502f6dc4c603f57ebe8dc7bcc4a4bc
- https://git.kernel.org/stable/c/76ab057de777723ec924654502d1a260ba7d7d54
- https://git.kernel.org/stable/c/b2a2ab039bd58f51355e33d7d3fc64605d7f870d
- https://git.kernel.org/stable/c/c05e76d6b249e5254c31994eedd06dd3cc90dee0
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/54xxx/CVE-2023-54026.json
- https://nvd.nist.gov/vuln/detail/CVE-2023-54026
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced7eba0c7641b0009818e469dbfcdd87a0155ab9d4Fixed39a0e723d3502f6dc4c603f57ebe8dc7bcc4a4bcFixed76ab057de777723ec924654502d1a260ba7d7d54Fixedc05e76d6b249e5254c31994eedd06dd3cc90dee0Fixedb2a2ab039bd58f51355e33d7d3fc64605d7f870d