CVE-2023-54026: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54026 is a use-after-free vulnerability in the Linux kernel's Operating Performance Points (OPP) subsystem, specifically in the lazy_opp_tables handling after probe deferral. The flaw was introduced when dev_pm_opp_of_find_icc_paths() in _allocate_opp_table() returns -EPROBE_DEFER, causing the opp_table to be freed, but failing to remove it from the global lazy_opp_tables list if it was already added due to required-opps usage. This can lead to kernel NULL pointer dereferences when the freed table is later iterated. The vulnerability affects Linux kernel versions from 5.12 up to (but not including) the patched releases 5.15.121, 6.1.40, 6.4.5, and 6.5. It was published on December 24, 2025, with an EPSS score of 0.018% and no CVSS score formally assigned by NVD at this time (Feedly, NVD).

The root cause is a use-after-free (CWE-416) in the Linux kernel's OPP (Operating Performance Points) driver (drivers/opp/of.c). When _allocate_opp_table() encounters a probe deferral error (-EPROBE_DEFER) from dev_pm_opp_of_find_icc_paths(), it frees the opp_table structure but neglects to remove it from the global lazy_opp_tables linked list if the table had already been added due to required-opps configuration. Subsequently, when the required-opps provider is registered, the kernel iterates over lazy_opp_tables and dereferences the already-freed pointer in lazy_link_required_opp_table() → _of_add_opp_table_v2(), triggering a NULL pointer dereference. The fix involves calling _of_clear_opp_table() in the error path to properly remove the entry from the list and adding missing mutex_destroy() calls (NVD, Feedly).

Successful triggering of this vulnerability causes a kernel NULL pointer dereference, resulting in a kernel panic and system crash, directly impacting availability. The crash occurs in a kernel worker thread (kworker/0:0), meaning it can be triggered during normal device initialization without requiring elevated privileges beyond those needed to load or probe a device driver. There is no evidence of confidentiality or integrity impact beyond the denial-of-service caused by the kernel crash (NVD).

The vulnerability is fixed in Linux kernel stable releases 5.15.121, 6.1.40, 6.4.5, and 6.5. Administrators should update to these or later kernel versions. The relevant upstream patches are available at the kernel.org stable tree (commits 39a0e723, 76ab057d, b2a2ab03, and c05e76d6). SUSE has also issued advisories (SUSE-2026-0281-1 and SUSE-2026-20876-1) incorporating these fixes for affected SUSE Linux Enterprise distributions (NVD, Feedly).