The Linux kernel's fastrpc driver contained a vulnerability (CVE-2026-31730) where the cctx->remote_heap pointer could be freed twice. Specifically, fastrpc_init_create_static_process() may free cctx->remote_heap on an error path without clearing the pointer, and later fastrpc_rpmsg_remove() frees it again if non-NULL. This double-free can lead to memory corruption. The issue was identified through static analysis and confirmed by manual review. A fix was implemented by clearing the pointer after freeing it in the error path to prevent double-free during cleanup. The vulnerability affects multiple Linux kernel versions before 6.8.0-1064.72 and related variants. The CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting a local attack vector with low complexity and significant impact on confidentiality, integrity, and availability. Official patches are available from Ubuntu and other Linux distributions.

Successful exploitation of this double-free vulnerability could lead to memory corruption, potentially allowing an attacker with local privileges to cause denial of service or escalate privileges by corrupting kernel memory. The CVSS score of 7.8 indicates high impact on confidentiality, integrity, and availability. However, exploitation requires local access with low privileges and no user interaction. No known exploits in the wild have been reported.

A patch is available and has been released by Linux kernel maintainers and Ubuntu. Users should apply the official Linux kernel updates that include the fix for CVE-2026-31730 and reboot their systems to ensure the vulnerability is mitigated. The fix involves clearing the cctx->remote_heap pointer after freeing it to prevent double-free. No additional mitigation steps are required beyond applying the official update.