{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-53161","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-06-09T07:44:35.388Z","datePublished":"2026-06-25T08:38:42.789Z","dateUpdated":"2026-06-28T06:39:37.235Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-06-28T06:39:37.235Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: fastrpc: fix use-after-free of fastrpc_user in workqueue context\n\nThere is a race between fastrpc_device_release() and the workqueue\nthat processes DSP responses. When the user closes the file descriptor,\nfastrpc_device_release() frees the fastrpc_user structure. Concurrently,\nan in-flight DSP invocation can complete and fastrpc_rpmsg_callback()\nschedules context cleanup via schedule_work(&ctx->put_work). If the\nworkqueue runs fastrpc_context_free() in parallel with or after\nfastrpc_device_release() has freed the user structure, it dereferences\nthe freed fastrpc_user. Depending on the state of the context at the\ntime of the race, any one of the following accesses can be hit:\n\n 1. fastrpc_buf_free() calls fastrpc_ipa_to_dma_addr(buf->fl->cctx, ...)\n    to strip the SID bits from the stored IOVA before passing the\n    physical address to dma_free_coherent().\n\n 2. fastrpc_free_map() reads map->fl->cctx->vmperms[0].vmid to\n    reconstruct the source permission bitmask needed for the\n    qcom_scm_assign_mem() call that returns memory from the DSP VM\n    back to HLOS.\n\n 3. fastrpc_free_map() acquires map->fl->lock to safely remove the\n    map node from the fl->maps list.\n\nThe resulting use-after-free manifests as:\n\n  pc : fastrpc_buf_free+0x38/0x80 [fastrpc]\n  lr : fastrpc_context_free+0xa8/0x1b0 [fastrpc]\n  fastrpc_context_free+0xa8/0x1b0 [fastrpc]\n  fastrpc_context_put_wq+0x78/0xa0 [fastrpc]\n  process_one_work+0x180/0x450\n  worker_thread+0x26c/0x388\n\nAdd kref-based reference counting to fastrpc_user. Have each invoke\ncontext take a reference on the user at allocation time and release it\nwhen the context is freed. Release the initial reference in\nfastrpc_device_release() at file close. Move the teardown of the user\nstructure — freeing pending contexts, maps, mmaps, and the channel\ncontext reference — into the kref release callback fastrpc_user_free(),\nso that it runs only when the last reference is dropped, regardless of\nwhether that happens at device close or after the final in-flight\ncontext completes."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"}}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/misc/fastrpc.c"],"versions":[{"version":"6cffd79504ce040f460831030d3069fa1c99bb71","lessThan":"c6e5c2be09f814377d7f1ce97370a5b7b3e02814","status":"affected","versionType":"git"},{"version":"6cffd79504ce040f460831030d3069fa1c99bb71","lessThan":"e1e3a05efe5954d5bad01157d79429d39a67a7ae","status":"affected","versionType":"git"},{"version":"6cffd79504ce040f460831030d3069fa1c99bb71","lessThan":"d42679eef34dd590b694ce3b666c5e2ba10cd4bf","status":"affected","versionType":"git"},{"version":"6cffd79504ce040f460831030d3069fa1c99bb71","lessThan":"df08fadcf0e5f3708365ec3b6d30b5aafd98bea1","status":"affected","versionType":"git"},{"version":"6cffd79504ce040f460831030d3069fa1c99bb71","lessThan":"ecea4967c2bff92c2fafbc59893f711b39f7b152","status":"affected","versionType":"git"},{"version":"6cffd79504ce040f460831030d3069fa1c99bb71","lessThan":"5278ccd357e0d7aeeb1e76c0f3e0e02894a9897c","status":"affected","versionType":"git"},{"version":"6cffd79504ce040f460831030d3069fa1c99bb71","lessThan":"fbe0947420eec18a84638d29468c2d563ce4e6a3","status":"affected","versionType":"git"},{"version":"6cffd79504ce040f460831030d3069fa1c99bb71","lessThan":"e85eb5feca8e254905ffa6c57a3c99c89a674a0f","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/misc/fastrpc.c"],"versions":[{"version":"5.1","status":"affected"},{"version":"0","lessThan":"5.1","status":"unaffected","versionType":"semver"},{"version":"5.10.259","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.210","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.176","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.143","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.94","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.36","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.0.13","lessThanOrEqual":"7.0.*","status":"unaffected","versionType":"semver"},{"version":"7.1","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.1","versionEndExcluding":"5.10.259"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.1","versionEndExcluding":"5.15.210"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.1","versionEndExcluding":"6.1.176"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.1","versionEndExcluding":"6.6.143"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.1","versionEndExcluding":"6.12.94"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.1","versionEndExcluding":"6.18.36"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.1","versionEndExcluding":"7.0.13"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.1","versionEndExcluding":"7.1"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/c6e5c2be09f814377d7f1ce97370a5b7b3e02814"},{"url":"https://git.kernel.org/stable/c/e1e3a05efe5954d5bad01157d79429d39a67a7ae"},{"url":"https://git.kernel.org/stable/c/d42679eef34dd590b694ce3b666c5e2ba10cd4bf"},{"url":"https://git.kernel.org/stable/c/df08fadcf0e5f3708365ec3b6d30b5aafd98bea1"},{"url":"https://git.kernel.org/stable/c/ecea4967c2bff92c2fafbc59893f711b39f7b152"},{"url":"https://git.kernel.org/stable/c/5278ccd357e0d7aeeb1e76c0f3e0e02894a9897c"},{"url":"https://git.kernel.org/stable/c/fbe0947420eec18a84638d29468c2d563ce4e6a3"},{"url":"https://git.kernel.org/stable/c/e85eb5feca8e254905ffa6c57a3c99c89a674a0f"}],"title":"misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context","x_generator":{"engine":"bippy-1.2.0"}}}}