CVE-2026-93069

What it actually does

Incorrect initialization order of scope-based pointers in OPP code causes registered cleanup handlers to execute in reverse sequence, allowing _opp_kref_release to dereference an opp pointer whose opp_table has already been freed.

Why it matters to the business

Linux systems performing dynamic voltage/frequency scaling may experience kernel memory corruption, crashes, or potential local privilege escalation during OPP table teardown.

How an attack unfolds

An attacker with local access triggers repeated OPP table allocation and release operations; the reversed cleanup order frees the opp_table while a reference still exists, enabling a subsequent use-after-free write or read when the kref release callback runs.

How to fix it

Update to a Linux kernel containing commit 173e02d67494 or the corrective patch that restores opp_table initialization before opp initialization. Rebuild and reboot all affected kernels.

How to confirm the fix worked

Inspect the OPP initialization site to confirm opp_table is declared and initialized before opp; run kernel selftests covering OPP table allocation and kref release under memory-pressure conditions.

Typical attack path

1. Obtain local code execution on a Linux system that uses the OPP framework
2. Force repeated creation and destruction of OPP tables under memory pressure
3. Trigger the kref release path that executes the incorrectly ordered cleanups
4. Reuse the freed opp_table memory to corrupt kernel structures or redirect execution

How to detect it

Review kernel logs for use-after-free warnings or oopses referencing _opp_kref_release and opp_table; examine auditd or syscall logs for unusual sequences of OPP-related ioctls or sysfs writes under memory-pressure conditions.

What your security team should do

• Prioritize kernel upgrades on any system exposing the OPP interface to untrusted local users
• Monitor vendor advisories for backported fixes in distribution kernels
• Apply defense-in-depth measures such as kernel hardening features (e.g., KASAN, hardened usercopy) until patches are deployed