CVE-2026-74405

In the Linux kernel, the following vulnerability has been resolved:

OPP: Fix race between OPP addition and lookup

A race exists between dev_pm_opp_add_dynamic() and

dev_pm_opp_find_freq_exact():

CPU0 (add) CPU1 (lookup)

------------------------------- ------------------------------

_opp_add()

mutex_lock()

list_add(&new_opp->node, head)

mutex_unlock() _opp_table_find_key()

mutex_lock()

dev_pm_opp_get(opp)

kref_get()

mutex_unlock()

kref_init(&new_opp->kref)

dev_pm_opp_put()

kref_put_mutex()

The newly added OPP is inserted into the list before its kref is

initialized. A concurrent lookup can find this OPP and increment its

reference count while it is still uninitialized, leading to refcount

corruption and a potential premature free.

Fix this by initializing ->kref and ->opp_table before making the OPP

visible via list_add(). This ensures any concurrent lookup observes a

fully initialized object.

[ Viresh: Updated commit log ]