CVE-2026-93069 OPP: Fix cleanup ordering
A use-after-free vulnerability in the Linux kernel OPP subsystem allows local attackers to potentially execute code or escalate privileges due to incorrect cleanup ordering.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-93069?
CVE-2026-93069 is an use after free vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
OPP: Fix cleanup ordering
Commit 173e02d67494 ("OPP: Initialize scope-based pointers inline") added initialization for all pointers. In some cases, the ordering was changed so that *opp_table was initialized after *opp. This also changes the order of the registered cleanup functions.
When the cleanup happens, this can cause use-after-free errors when the last reference is released and the release function _opp_kref_release tries to access the already freed opp->opp_table.
Initialize *opp_table before *opp again to fix this and ensure the correct cleanup order.
Which versions are affected by CVE-2026-93069?
How do I fix CVE-2026-93069?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-93069 being exploited?
There is no known exploitation of CVE-2026-93069 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-93069, GHSA-x3pg-c8fj-93pv, UBUNTU-CVE-2026-93069.