CVE-2026-74405

A flaw was found in the Linux kernel. A race condition exists within the Optimized Power Performance (OPP) subsystem, where a newly added OPP object is exposed before its internal reference count is fully initialized. A concurrent operation can then increment this uninitialized reference count, leading to data corruption. This corruption can cause the object to be prematurely released, potentially resulting in system instability or a denial of service.

A race in the OPP core can expose a newly added dev_pm_opp object to lookup before its kref and table pointer are fully initialized. A concurrent dev_pm_opp_find_freq_exact() path can take a reference on this partially initialized object, which can corrupt the reference count and may lead to premature free or use-after-free. For the CVSS the PR:L is used for the paranoid score because reduced capability root, container root, or a delegated power management service that can trigger OPP updates should not be treated as full administrative control in practical risk analysis. The issue is not network reachable and requires local interaction with a platform path that can add and look up dynamic OPP entries. Impact is at least local denial of service via kernel crash and in worst case may allow confidentiality and integrity impact due to memory corruption and should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.