The Linux kernel fastrpc driver used find_vma() to locate the virtual memory area for a user pointer and compute a DMA address offset. If the pointer was in a gap before the returned VMA, the calculation (ptr & PAGE_MASK) - vma->vm_start underflowed, corrupting the DMA address sent to the DSP. The fix replaces find_vma() with vma_lookup(), which returns NULL when the address is not contained within any VMA, preventing the underflow and address corruption.

Corruption of the DMA address sent to the DSP could lead to incorrect memory accesses or data corruption during DMA operations. The exact impact is limited to the fastrpc driver context and depends on how corrupted DMA addresses affect the DSP and system behavior. No known exploits in the wild have been reported.

A fix for this vulnerability has been implemented in the Linux kernel by replacing find_vma() with vma_lookup() in the fastrpc driver. Users should apply the official Linux kernel updates that include this fix. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor advisory or Linux kernel release notes for the specific patch and remediation guidance.