CVE-2023-54026

What it actually does

Use-after-free in the OPP subsystem: when dev_pm_opp_of_find_icc_paths returns -EPROBE_DEFER, the opp_table is freed without being removed from the global lazy_opp_tables list; subsequent addition of a required-opps provider then dereferences the freed structure during lazy_link_required_opp_table.

Why it matters to the business

Kernel crashes (NULL pointer dereference) can occur on systems using OPP tables with required-opps and interconnect paths, leading to denial of service, failed boot, or disrupted device initialization; the affected kernel versions are widely deployed in servers, embedded devices, and cloud instances.

How an attack unfolds

An attacker with the ability to control device probe ordering or load modules that trigger interconnect path deferral can cause an opp_table to be added to lazy_opp_tables and then freed; later, when the required-opps provider registers, the kernel iterates the stale list entry and crashes.

How to fix it

Update to a kernel containing commit 39a0e723d3502f6dc4c603f57ebe8dc7bcc4a4bc or later; for packaged distributions apply the fixed versions (e.g., nfs-subdir-external-provisioner 4.0.18-r22). Reboot after upgrade.

How to confirm the fix worked

Confirm the running kernel contains the fix commit or is built from a tree after 39a0e723d350; verify absence of the described error path by code inspection or by checking that _of_clear_opp_table is called on the -EPROBE_DEFER path.

Typical attack path

1. Trigger -EPROBE_DEFER return from dev_pm_opp_of_find_icc_paths during _allocate_opp_table
2. opp_table is placed on lazy_opp_tables but not removed on the error path
3. Required-opps provider is later registered
4. Kernel walks lazy_opp_tables and dereferences the already-freed opp_table

How to detect it

Inspect kernel logs for oops or panic messages containing lazy_link_required_opp_table, _of_add_opp_table_v2, or NULL pointer dereference during opp table iteration; correlate with device probe deferral events involving interconnect paths.

What your security team should do

• Prioritize kernel updates on all systems exposing OPP/interconnect functionality
• Monitor for kernel oops involving _of_add_opp_table_v2 or lazy_link_required_opp_table
• Apply the fixed package versions listed for Chainguard and Wolfi images immediately