Linux Kernel CVE-2026-74405

Exploitation requires a local account with sufficient privilege to interact with the OPP subsystem (PR:L per CVSS), meaning an unprivileged shell user on most Linux configurations. The OPP subsystem must be active, which occurs on platforms using kernel-managed DVFS - primarily ARM, ARM64, and RISC-V SoCs with multiple operating performance points defined in the device tree or ACPI tables. The race is constrained to a narrow window between list_add() and kref_init() in _opp_add(), requiring concurrent execution of OPP addition and lookup - this is most naturally triggered during system startup or dynamic OPP table population (e.g., when a cpufreq driver loads). Standard x86 server or desktop deployments are generally unaffected because the OPP subsystem is not active in that context. User interaction is not required (UI:N), and network access is not involved (AV:L). The practical limiting factors are: local access requirement, OPP-enabled platform requirement, and the need to time concurrent kernel-space operations - elevating effective complexity beyond the AC:L assigned in the NVD vector.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H scores 7.8 (High), reflecting local authenticated exploitation with full impact across confidentiality, integrity, and availability. However, the AC:L assignment is likely optimistic - race conditions inherently require precise timing, and independently this vulnerability warrants AC:H, which would reduce the score to approximately 6.3. EPSS at 0.17% (6th percentile) strongly corroborates low observed exploitation activity. No CISA KEV listing and no public POC code have been identified at the time of analysis. The OPP subsystem is most active on ARM-based systems with power management-capable SoCs (embedded, mobile, SBC platforms); x86 server deployments are unlikely to be affected in practice. Real-world risk is moderate: the vulnerability requires concurrent scheduling of OPP addition and lookup, which is not trivially reproducible outside of DVFS-heavy workloads or targeted stress testing. The H/H/H impact is credible only if the race is won and a use-after-free is successfully weaponized - a non-trivial kernel exploitation task. Priority is HIGH for ARM-based embedded and mobile Linux environments; LOW for general-purpose x86 servers.

A local low-privileged user on an ARM-based Linux system (e.g., an embedded device or SBC running kernel 6.x or 7.x pre-patch) spawns two threads: one repeatedly calls into the OPP subsystem to add performance points (via a driver or sysfs interface), while a second thread concurrently enumerates available OPP frequencies. By winning the race window between list_add() and kref_init() in the kernel, the lookup thread obtains a pointer to an uninitialized OPP object and increments its reference count, corrupting the kref state and triggering a premature free. No public POC exists, so this scenario requires custom kernel exploit development.