Executive brief
A vulnerability was identified in the Linux kernel's FastRPC driver, which is used for communication between the main processor and digital signal processors (DSPs) in certain mobile and embedded systems. Under specific timing conditions during system startup, the driver may attempt to access memory that has not yet been initialized. This can lead to a system crash (NULL pointer dereference), potentially causing a denial of service during the boot process.
Technical details
A race condition exists in the Linux kernel FastRPC driver (drivers/misc/fastrpc.c) during the rpmsg probe sequence. The vulnerability occurs because the rpmsg channel becomes active as soon as the driver is bound, allowing the `fastrpc_rpmsg_callback()` to be triggered before `dev_set_drvdata()` has populated the necessary context or before internal structures like spinlocks are initialized. An attacker or a specifically timed hardware event (e.g., from the DSP) can trigger this callback, resulting in a NULL pointer dereference when the kernel attempts to acquire an uninitialized spinlock. The fix involves reordering initialization steps to ensure all structures are ready before they are exposed to callbacks and adding explicit NULL checks.
Affected products
- Linux Linux 5.1 and later
Timeline
- 2026-05-30: other: Patch submitted by developer
- 2026-06-25: disclosed: CVE published
References
- https://git.kernel.org/stable/c/4bfdf0a9855df55e9e031ca6a25b855820590c70
- https://git.kernel.org/stable/c/5401fb4fe10fac6134c308495df18ed74aebb9c4
- https://git.kernel.org/stable/c/8fb4a23df5b7c02929b62e5dbc270ec7c42b8134
- https://git.kernel.org/stable/c/d5de9cb5355db36438edc621dde3673e3f235767
- https://git.kernel.org/stable/c/d77583ca33299fede0c194744ef2284e7ba5b763