CVE-2026-53161

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context

There is a race between fastrpc_device_release() and the workqueue

that processes DSP responses. When the user closes the file descriptor,

fastrpc_device_release() frees the fastrpc_user structure. Concurrently,

an in-flight DSP invocation can complete and fastrpc_rpmsg_callback()

schedules context cleanup via schedule_work(&ctx->put_work). If the

workqueue runs fastrpc_context_free() in parallel with or after

fastrpc_device_release() has freed the user structure, it dereferences

the freed fastrpc_user. Depending on the state of the context at the

time of the race, any one of the following accesses can be hit:

1. fastrpc_buf_free() calls fastrpc_ipa_to_dma_addr(buf->fl->cctx, ...)

to strip the SID bits from the stored IOVA before passing the

physical address to dma_free_coherent().

2. fastrpc_free_map() reads map->fl->cctx->vmperms[0].

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References