In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context There is… (CVE-2026-53161)
In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context There is a race between fastrpc_device_release() and the workqueue that processes DSP responses. When the user closes the file descriptor, fastrpc_device_release() frees the fastrpc_user structure. Concurrently, an in-flight DSP invocation can complete and fastrpc_rpmsg_callback() schedules context cleanup via schedule_work(&ctx->put_work). If the workqueue runs fastrpc_context_free() in parallel with or after fastrpc_device_release() has freed the user structure, it dereferences the freed fastrpc_user. Depending on the state of the context at the time of the race, any one of the following accesses can be hit: 1. fastrpc_buf_free() calls fastrpc_ipa_to_dma_addr(buf->fl->cctx, ...) to strip the SID bits from the stored IOVA before passing the physical address to dma_free_coherent(). 2. fastrpc_free_map() reads map->fl->cctx->vmperms[0].vmid to reconstruct the source permission bitmask needed for the qcom_scm_assign_mem() call that returns memory from the DSP VM back to HLOS. 3. fastrpc_free_map() acquires map->fl->lock to safely remove the map node from the fl->maps list. The resulting use-after-free manifests as: pc : fastrpc_buf_free+0x38/0x80 [fastrpc] lr : fastrpc_context_free+0xa8/0x1b0 [fastrpc] fastrpc_context_free+0xa8/0x1b0 [fastrpc] fastrpc_context_put_wq+0x78/0xa0 [fastrpc] process_one_work+0x180/0x450 worker_thread+0x26c/0x388 Add kref-based reference counting to fastrpc_user. Have each invoke context take a reference on the user at allocation time and release it when the context is freed. Release the initial reference in fastrpc_device_release() at file close. Move the teardown of the user structure — freeing pending contexts, maps, mmaps, and the channel context reference — into the kref release callback fastrpc_user_free(), so that it runs only when the last reference is dropped, regardless of whether that happens at device close or after the final in-flight context completes.
AI Analysis
Technical Summary
The vulnerability arises from a race condition in the Linux kernel's fastrpc driver where the fastrpc_user structure is freed by fastrpc_device_release() when the user closes the file descriptor, but concurrently, a workqueue may run fastrpc_context_free() that accesses the already freed structure. This use-after-free occurs in multiple code paths including fastrpc_buf_free(), fastrpc_free_map(), and lock handling, potentially causing memory corruption or system instability. The fix involves adding kref-based reference counting to the fastrpc_user structure to ensure it is only freed after all references, including those held by in-flight contexts, are released.
Potential Impact
Successful exploitation of this use-after-free vulnerability can lead to high impact outcomes including memory corruption, denial of service (system crashes), and potentially arbitrary code execution within the kernel context. The CVSS vector indicates local attack vector with low complexity and no user interaction, and it affects confidentiality, integrity, and availability at a high level.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix involves adding reference counting to prevent premature freeing of the fastrpc_user structure. Until an official patch is available, avoid exposing the vulnerable interface to untrusted users or processes. Monitor vendor channels for updates and apply official fixes once released.
In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context There is… (CVE-2026-53161)
Description
In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context There is a race between fastrpc_device_release() and the workqueue that processes DSP responses. When the user closes the file descriptor, fastrpc_device_release() frees the fastrpc_user structure. Concurrently, an in-flight DSP invocation can complete and fastrpc_rpmsg_callback() schedules context cleanup via schedule_work(&ctx->put_work). If the workqueue runs fastrpc_context_free() in parallel with or after fastrpc_device_release() has freed the user structure, it dereferences the freed fastrpc_user. Depending on the state of the context at the time of the race, any one of the following accesses can be hit: 1. fastrpc_buf_free() calls fastrpc_ipa_to_dma_addr(buf->fl->cctx, ...) to strip the SID bits from the stored IOVA before passing the physical address to dma_free_coherent(). 2. fastrpc_free_map() reads map->fl->cctx->vmperms[0].vmid to reconstruct the source permission bitmask needed for the qcom_scm_assign_mem() call that returns memory from the DSP VM back to HLOS. 3. fastrpc_free_map() acquires map->fl->lock to safely remove the map node from the fl->maps list. The resulting use-after-free manifests as: pc : fastrpc_buf_free+0x38/0x80 [fastrpc] lr : fastrpc_context_free+0xa8/0x1b0 [fastrpc] fastrpc_context_free+0xa8/0x1b0 [fastrpc] fastrpc_context_put_wq+0x78/0xa0 [fastrpc] process_one_work+0x180/0x450 worker_thread+0x26c/0x388 Add kref-based reference counting to fastrpc_user. Have each invoke context take a reference on the user at allocation time and release it when the context is freed. Release the initial reference in fastrpc_device_release() at file close. Move the teardown of the user structure — freeing pending contexts, maps, mmaps, and the channel context reference — into the kref release callback fastrpc_user_free(), so that it runs only when the last reference is dropped, regardless of whether that happens at device close or after the final in-flight context completes.
CVSS v3.1
Score 7.8high
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability arises from a race condition in the Linux kernel's fastrpc driver where the fastrpc_user structure is freed by fastrpc_device_release() when the user closes the file descriptor, but concurrently, a workqueue may run fastrpc_context_free() that accesses the already freed structure. This use-after-free occurs in multiple code paths including fastrpc_buf_free(), fastrpc_free_map(), and lock handling, potentially causing memory corruption or system instability. The fix involves adding kref-based reference counting to the fastrpc_user structure to ensure it is only freed after all references, including those held by in-flight contexts, are released.
Potential Impact
Successful exploitation of this use-after-free vulnerability can lead to high impact outcomes including memory corruption, denial of service (system crashes), and potentially arbitrary code execution within the kernel context. The CVSS vector indicates local attack vector with low complexity and no user interaction, and it affects confidentiality, integrity, and availability at a high level.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix involves adding reference counting to prevent premature freeing of the fastrpc_user structure. Until an official patch is available, avoid exposing the vulnerable interface to untrusted users or processes. Monitor vendor channels for updates and apply official fixes once released.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-4v48-c98q-4vpc
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-53161"]
- Ecosystems
- []
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a4c344c27e9c797195fbd89
Added to database: 07/06/2026, 23:03:40 UTC
Last enriched: 07/06/2026, 23:29:06 UTC
Last updated: 07/31/2026, 19:24:49 UTC
Views: 21
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.