CVE-2026-93069: OPP: Fix cleanup ordering
In the Linux kernel, the following vulnerability has been resolved:
OPP: Fix cleanup ordering
Commit 173e02d67494 ("OPP: Initialize scope-based pointers inline") added initialization for all pointers. In some cases, the ordering was changed so that opptable was initialized after opp. This also changes the order of the registered cleanup functions.
When the cleanup happens, this can cause use-after-free errors when the last reference is released and the release function oppkrefrelease tries to access the already freed opp->opptable.
Initialize opptable before opp again to fix this and ensure the correct cleanup order.
Affected Software
Event History
Frequently Asked Questions
What condition triggers the use-after-free?
The issue occurs during cleanup when the final reference is released. The registered cleanup order can free opp->opp_table before _opp_kref_release accesses it through opp.
Which component is affected?
The affected code is the Linux kernel Operating Performance Points (OPP) subsystem. The defect concerns cleanup ordering for scope-based pointers in that subsystem.
What is the available fix?
The fix restores initialization of opp_table before opp, which restores the required cleanup order and prevents _opp_kref_release from accessing an already freed opp_table.