Executive brief
The Linux kernel's fastrpc driver manages memory buffers used for inter-processor communication with digital signal processors (DSPs). A race condition in the buffer unmapping logic could allow multiple concurrent unmap requests to corrupt internal data structures, potentially leading to memory leaks, crashes, or data corruption. This affects systems using fastrpc-based hardware acceleration.
Technical details
The vulnerability is a race condition in the fastrpc misc driver's buffer unmapping implementation (fastrpc_req_munmap_impl). The root cause is that buffer entries were removed from the managed list after unmapping from the DSP, creating a window where concurrent unmap operations could corrupt the list structure. The fix moves list removal before the unmap operation and re-adds the buffer to the list if unmap fails, allowing retry or cleanup during device release. The vulnerable code path requires local access to open the fastrpc device and invoke unmapping operations, but no authentication bypass is needed. An attacker with unprivileged local access can trigger the race condition to cause denial of service or potentially gain elevated privileges through heap corruption.
Affected products
- Linux Linux kernel All versions with fastrpc mmap/unmap support (introduced in 2419e55e532de; patched upstream commit 6102ceb4eab845743ee57acd3863fbd06e93c927)
Timeline
- 2026-08-22: disclosed: CVE-2026-74647 published
- 2026-07-24: patched: Upstream fix committed by Ekansh Gupta
- 2026-08-19: patched: Fix merged to Linux stable tree