CVE-2023-54026

A use-after-free vulnerability exists in the Linux kernel's Operating Performance Points (OPP) framework. When dev_pm_opp_of_find_icc_paths() returns -EPROBE_DEFER during _allocate_opp_table(), the opp_table is freed to wait for interconnect paths. However, if the OPP table uses required-opps, it may already be added to the global lazy_opp_tables list. The error path does not remove the table from this list, leading to a dangling pointer.

An attacker can trigger this condition by causing a device probe to defer and then having the required-opp provider added later. The vulnerability is triggered when the system iterates over the lazy_opp_tables list to link required-opps, resulting in a use-after-free. The crash manifests as a NULL pointer dereference in _of_add_opp_table_v2() (specifically lazy_link_required_opp_table()) as shown in the kernel panic.

The impact includes denial of service via kernel crash and potentially arbitrary code execution if an attacker can control the freed memory. The vulnerability is local and requires control over device probe ordering.

The fix, included in Linux kernel stable commit c05e76d6b249, calls _of_clear_opp_table() to remove the table from the list and adds missing mutex_destroy() calls [1]. Users should apply the latest kernel updates to mitigate this issue.