PT-2026-52257 · Linux · Linux

Published 2026-06-25 · Updated 2026-06-25 · CVE-2026-53161

Mitre

In the Linux kernel, the following vulnerability has been resolved:

misc: fastrpc: fix use-after-free of fastrpc user in workqueue context

There is a race between fastrpc device release() and the workqueue that processes DSP responses. When the user closes the file descriptor, fastrpc device release() frees the fastrpc user structure. Concurrently, an in-flight DSP invocation can complete and fastrpc rpmsg callback() schedules context cleanup via schedule work(&ctx->put work). If the workqueue runs fastrpc context free() in parallel with or after fastrpc device release() has freed the user structure, it dereferences the freed fastrpc user. Depending on the state of the context at the time of the race, any one of the following accesses can be hit:

1. fastrpc buf free() calls fastrpc ipa to dma addr(buf->fl->cctx, ...) to strip the SID bits from the stored IOVA before passing the physical address to dma free coherent().
2. fastrpc free map() reads map->fl->cctx->vmperms[0].vmid to reconstruct the source permission bitmask needed for the qcom scm assign mem() call that returns memory from the DSP VM back to HLOS.
3. fastrpc free map() acquires map->fl->lock to safely remove the map node from the fl->maps list.

The resulting use-after-free manifests as:

pc : fastrpc buf free+0x38/0x80 [fastrpc] lr : fastrpc context free+0xa8/0x1b0 [fastrpc] fastrpc context free+0xa8/0x1b0 [fastrpc] fastrpc context put wq+0x78/0xa0 [fastrpc] process one work+0x180/0x450 worker thread+0x26c/0x388

Add kref-based reference counting to fastrpc user. Have each invoke context take a reference on the user at allocation time and release it when the context is freed. Release the initial reference in fastrpc device release() at file close. Move the teardown of the user structure — freeing pending contexts, maps, mmaps, and the channel context reference — into the kref release callback fastrpc user free(), so that it runs only when the last reference is dropped, regardless of whether that happens at device close or after the final in-flight context completes.

Related Identifiers

CVE-2026-53161

Affected Products

Linux

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-53161 · Security Note
• https://git.kernel.org/stable/c/5278ccd357e0d7aeeb1e76c0f3e0e02894a9897c · Note
• https://git.kernel.org/stable/c/e85eb5feca8e254905ffa6c57a3c99c89a674a0f · Note
• https://git.kernel.org/stable/c/d42679eef34dd590b694ce3b666c5e2ba10cd4bf · Note
• https://git.kernel.org/stable/c/df08fadcf0e5f3708365ec3b6d30b5aafd98bea1 · Note
• https://git.kernel.org/stable/c/fbe0947420eec18a84638d29468c2d563ce4e6a3 · Note
• https://git.kernel.org/stable/c/e1e3a05efe5954d5bad01157d79429d39a67a7ae · Note
• https://git.kernel.org/stable/c/ecea4967c2bff92c2fafbc59893f711b39f7b152 · Note
• https://git.kernel.org/stable/c/c6e5c2be09f814377d7f1ce97370a5b7b3e02814 · Note