CVE-2026-74405

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> OPP: Fix race between OPP addition and lookup<br /> <br /> A race exists between dev_pm_opp_add_dynamic() and<br /> dev_pm_opp_find_freq_exact():<br /> <br /> CPU0 (add) CPU1 (lookup)<br /> ------------------------------- ------------------------------<br /> _opp_add()<br /> mutex_lock()<br /> list_add(&amp;new_opp-&gt;node, head)<br /> mutex_unlock() _opp_table_find_key()<br /> mutex_lock()<br /> dev_pm_opp_get(opp)<br /> kref_get()<br /> mutex_unlock()<br /> kref_init(&amp;new_opp-&gt;kref)<br /> dev_pm_opp_put()<br /> kref_put_mutex()<br /> <br /> The newly added OPP is inserted into the list before its kref is<br /> initialized. A concurrent lookup can find this OPP and increment its<br /> reference count while it is still uninitialized, leading to refcount<br /> corruption and a potential premature free.<br /> <br /> Fix this by initializing -&gt;kref and -&gt;opp_table before making the OPP<br /> visible via list_add(). This ensures any concurrent lookup observes a<br /> fully initialized object.<br /> <br /> [ Viresh: Updated commit log ]