Executive brief
A security vulnerability has been identified in the Linux kernel's FastRPC driver, which is used for communication between the main processor and digital signal processors (DSPs). A race condition could allow a local attacker to cause a system crash or potentially execute unauthorized code by triggering a 'use-after-free' error during memory unmapping operations. This could lead to a loss of system availability or a compromise of kernel integrity.
Technical details
A use-after-free race condition exists in the fastrpc_map_create function within drivers/misc/fastrpc.c. The vulnerability occurs because fastrpc_map_lookup returns a raw pointer after releasing the fl->lock, allowing a concurrent MEM_UNMAP operation to free the underlying map object before the caller can increment its reference count via kref_get_unless_zero. An attacker can exploit this timing window to trigger a use-after-free on a freed slab object. The fix involves restoring the take_ref parameter to fastrpc_map_lookup to ensure the reference is acquired atomically while the lock is still held.
Affected products
- Linux Linux Kernel 6.1.156 to 6.1.176, 6.6.112 to 6.6.143, 6.12.53 to 6.12.94, 6.17.3 to 6.18
Timeline
- 2026-05-30: other: Patch authored
- 2026-06-25: advisory: CVE published
References
- https://git.kernel.org/stable/c/07ebe87915d8accdaba20c4f88c5ae430fe62fbb
- https://git.kernel.org/stable/c/0a3b87293fbd34fda651e6aead9964f84b893962
- https://git.kernel.org/stable/c/5b0166112019d1dce30b976ab28fd67f7f0be532
- https://git.kernel.org/stable/c/8b080c89183196fd3e49212f2a1a1c4a29335b9c
- https://git.kernel.org/stable/c/992f121796b7ca83a5a8b93da24e971363206218
- https://git.kernel.org/stable/c/f20f6512ecb75c816e0debf4551a138f098615c4