Executive brief
A vulnerability in the Linux kernel's FastRPC driver could allow a local user to cause a system crash or potentially gain unauthorized access. FastRPC is a mechanism used to communicate with Digital Signal Processors (DSPs) in mobile and embedded devices. The issue occurs when the system tries to clean up resources after a program closes, but a background task is still trying to use those same resources, leading to a memory error.
Technical details
A use-after-free vulnerability exists in the Linux kernel's FastRPC driver (drivers/misc/fastrpc.c). A race condition occurs between fastrpc_device_release(), which frees the fastrpc_user structure when a file descriptor is closed, and the workqueue processing DSP responses (fastrpc_rpmsg_callback). If the workqueue executes fastrpc_context_free() after the user structure has been freed, it dereferences the stale pointer during buffer freeing or map removal. This can lead to kernel panics or memory corruption. The fix introduces kref-based reference counting to ensure the fastrpc_user structure is only destroyed after all in-flight contexts have completed.
Affected products
- Linux Linux Kernel All versions prior to the June 2026 patches
Timeline
- 2026-05-30: other: Patch authored by Qualcomm engineers
- 2026-06-19: patched: Commits merged into stable kernel branches
- 2026-06-25: disclosed: CVE-2026-53161 published
References
- https://git.kernel.org/stable/c/5278ccd357e0d7aeeb1e76c0f3e0e02894a9897c
- https://git.kernel.org/stable/c/c6e5c2be09f814377d7f1ce97370a5b7b3e02814
- https://git.kernel.org/stable/c/d42679eef34dd590b694ce3b666c5e2ba10cd4bf
- https://git.kernel.org/stable/c/df08fadcf0e5f3708365ec3b6d30b5aafd98bea1
- https://git.kernel.org/stable/c/e1e3a05efe5954d5bad01157d79429d39a67a7ae
- https://git.kernel.org/stable/c/e85eb5feca8e254905ffa6c57a3c99c89a674a0f
- https://git.kernel.org/stable/c/ecea4967c2bff92c2fafbc59893f711b39f7b152