---
id: CVE-2026-74405
title: 'OPP: Fix race between OPP addition and lookup'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  OPP: Fix race between OPP addition and lookup

  A race exists between dev_pm_opp_add_dynamic() and
  dev_pm_opp_find_freq_exact():

    CPU0 (add)                          C…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 7034764a1e4a6edbb60914e89aad8384e3fe5d17 <
    46696b0b2123475d7f95909435c09808fc5ffd23
  - >-
    Linux >= 7034764a1e4a6edbb60914e89aad8384e3fe5d17 <
    bb75bd7d9ae7672034f73ce67a57e6ac89bb39e5
  - >-
    Linux >= 7034764a1e4a6edbb60914e89aad8384e3fe5d17 <
    f5e1cc9a284bff2510981643a5bca4bc4c21b81a
  - Linux 4.11
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T18:55:48.602720Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:05:43.186Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74405'
references:
  - url: 'https://git.kernel.org/stable/c/46696b0b2123475d7f95909435c09808fc5ffd23'
  - url: 'https://git.kernel.org/stable/c/bb75bd7d9ae7672034f73ce67a57e6ac89bb39e5'
  - url: 'https://git.kernel.org/stable/c/f5e1cc9a284bff2510981643a5bca4bc4c21b81a'
tags:
  - cve.org
epss: 0.00128
epssPercentile: 0.02153
ingestedAt: '2026-10-16T19:46:24.367Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

OPP: Fix race between OPP addition and lookup

A race exists between dev_pm_opp_add_dynamic() and
dev_pm_opp_find_freq_exact():

  CPU0 (add)                          CPU1 (lookup)
  -------------------------------     ------------------------------
  _opp_add()
    mutex_lock()
    list_add(&new_opp->node, head)
    mutex_unlock()                    _opp_table_find_key()
                                        mutex_lock()
                                        dev_pm_opp_get(opp)
                                          kref_get()
                                        mutex_unlock()
    kref_init(&new_opp->kref)
                                      dev_pm_opp_put()
                                        kref_put_mutex()

The newly added OPP is inserted into the list before its kref is
initialized. A concurrent lookup can find this OPP and increment its
reference count while it is still uninitialized, leading to refcount
corruption and a potential premature free.

Fix this by initializing ->kref and ->opp_table before making the OPP
visible via list_add(). This ensures any concurrent lookup observes a
fully initialized object.

[ Viresh: Updated commit log ]

## Affected

- `Linux >= 7034764a1e4a6edbb60914e89aad8384e3fe5d17 < 46696b0b2123475d7f95909435c09808fc5ffd23`
- `Linux >= 7034764a1e4a6edbb60914e89aad8384e3fe5d17 < bb75bd7d9ae7672034f73ce67a57e6ac89bb39e5`
- `Linux >= 7034764a1e4a6edbb60914e89aad8384e3fe5d17 < f5e1cc9a284bff2510981643a5bca4bc4c21b81a`
- `Linux 4.11`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.