Executive brief
The Linux kernel's fastrpc driver (used for communication with digital signal processors) has a race condition in how it handles memory-mapped buffers when an invoke operation is interrupted by a signal. An attacker with local access could exploit this to cause memory corruption, denial of service, or potentially achieve code execution on systems running vulnerable kernel versions.
Technical details
This is a race condition (CWE-362) in the fastrpc driver's handling of interrupted remote procedure calls. When wait_for_completion_interruptible() returns -ERESTARTSYS due to a signal, the fastrpc_internal_invoke() function moves buffers from fl->mmaps to cctx->invoke_interrupted_mmaps using list_del()/list_add_tail() operations without holding the fl->lock spinlock. This lock is required by all other fl->mmaps accessors (fastrpc_req_mmap() and fastrpc_req_munmap()), creating a data race. A local attacker can trigger concurrent access to the list, causing corruption of kernel list structures and potentially enabling memory corruption or code execution. The fix wraps the list migration in spin_lock/spin_unlock calls to ensure proper synchronization.
Affected products
- Linux Linux Kernel Multiple versions prior to the fix commit b85a0e91d7d6cd06a53c881a46f749cfcef416a2
Timeline
- 2026-08-22: disclosed
- 2026-08-19: patched: Fix commit b85a0e91d7d6cd06a53c881a46f749cfcef416a2