Executive brief
A vulnerability in the Linux kernel's FastRPC driver could lead to memory corruption. FastRPC is a mechanism used to offload tasks to a Digital Signal Processor (DSP), often found in mobile and embedded devices. An attacker could potentially exploit this to corrupt DMA addresses, leading to system instability or unauthorized memory access.
Technical details
The vulnerability exists in the fastrpc_get_args() function within drivers/misc/fastrpc.c. The code uses find_vma() to locate the Virtual Memory Area (VMA) for a user-provided pointer. However, find_vma() can return the first VMA with an end address greater than the provided pointer, even if the pointer itself is not within that VMA (i.e., it falls in a gap). When this occurs, the calculation '(ptr & PAGE_MASK) - vma->vm_start' results in an integer underflow. This underflow corrupts the DMA address subsequently sent to the DSP. The fix replaces find_vma() with vma_lookup(), which correctly returns NULL if the address is not strictly contained within a VMA.
Affected products
- Linux Linux Kernel 5.2 to 5.15.210, 6.1.176, 6.6.143, 6.12.94
Timeline
- 2026-05-30: patched: Initial patch authored
- 2026-06-25: disclosed: CVE published
References
- https://git.kernel.org/stable/c/2d0f47e27c1fa718b29c69aa7c96a2c5161bc2c2
- https://git.kernel.org/stable/c/464c6ad2aa16e1e1df9d559289199356493d1e00
- https://git.kernel.org/stable/c/53e06f8a3c2b085c31bf1284e2ebcb8036e99625
- https://git.kernel.org/stable/c/708c17b52c60fe7a57e73b495bdee50f58feb48c
- https://git.kernel.org/stable/c/7ba7b30ddb04646d4d638f4d8c4718a304bbbddd
- https://git.kernel.org/stable/c/d3e26df2e8eb361e6bef096b2fd565476a1f14c4
- https://git.kernel.org/stable/c/e69e306a4cccb40a73511350cb280825a556ce3c