# CVE-2023-54026: opp: Fix use-after-free in lazy_opp_tables after probe deferral

> A use-after-free in the Linux kernel OPP subsystem can cause a crash when probe deferral occurs with required-opps, leading to denial of service.

- **Severity:** High 7.8 (`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 24 Dec 2025
- **Updated:** 5 Aug 2026
- **Also known as:** BELL-CVE-2023-54026, DEBIAN-CVE-2023-54026, GHSA-m34w-8vx7-2jww, UBUNTU-CVE-2023-54026

## What is CVE-2023-54026?

CVE-2023-54026 is a high-severity use after free vulnerability in Linux, published on 24 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

opp: Fix use-after-free in lazy_opp_tables after probe deferral

When dev_pm_opp_of_find_icc_paths() in _allocate_opp_table() returns
-EPROBE_DEFER, the opp_table is freed again, to wait until all the
interconnect paths are available.

However, if the OPP table is using required-opps then it may already
have been added to the global lazy_opp_tables list. The error path
does not remove the opp_table from the list again.

This can cause crashes later when the provider of the required-opps
is added, since we will iterate over OPP tables that have already been
freed. E.g.:

  Unable to handle kernel NULL pointer dereference when read
  CPU: 0 PID: 7 Comm: kworker/0:0 Not tainted 6.4.0-rc3
  PC is at _of_add_opp_table_v2 (include/linux/of.h:949
  drivers/opp/of.c:98 drivers/opp/of.c:344 drivers/opp/of.c:404
  drivers/opp/of.c:1032) -> lazy_link_required_opp_table()

Fix this by calling _of_clear_opp_table() to remove the opp_table from
the list and clear other allocated resources. While at it, also add the
missing mutex_destroy() calls in the error path.

## Which versions are affected by CVE-2023-54026?


## How do I fix CVE-2023-54026?

Apply the vendor's patch.

## Is CVE-2023-54026 being exploited?

There is no known exploitation of CVE-2023-54026 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2023-54026 and fix it if it is affected.

What it is: CVE-2023-54026 is a high-severity use after free vulnerability in Linux, published on 24 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2023-54026 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2023-54026/ (Markdown: https://insights.sbomify.com/CVE-2023-54026/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2023-54026
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-54026
- OSV: https://osv.dev/vulnerability/CVE-2023-54026

---
From sbomify Insights: https://insights.sbomify.com/CVE-2023-54026/
Summaries are generated and may contain mistakes; the official description above is the record.