The vulnerability arises from a race condition in the Linux kernel's fastrpc driver where the fastrpc_user structure is freed by fastrpc_device_release() when the user closes the file descriptor, but concurrently, a workqueue may run fastrpc_context_free() that accesses the already freed structure. This use-after-free occurs in multiple code paths including fastrpc_buf_free(), fastrpc_free_map(), and lock handling, potentially causing memory corruption or system instability. The fix involves adding kref-based reference counting to the fastrpc_user structure to ensure it is only freed after all references, including those held by in-flight contexts, are released.

Successful exploitation of this use-after-free vulnerability can lead to high impact outcomes including memory corruption, denial of service (system crashes), and potentially arbitrary code execution within the kernel context. The CVSS vector indicates local attack vector with low complexity and no user interaction, and it affects confidentiality, integrity, and availability at a high level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix involves adding reference counting to prevent premature freeing of the fastrpc_user structure. Until an official patch is available, avoid exposing the vulnerable interface to untrusted users or processes. Monitor vendor channels for updates and apply official fixes once released.