Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2026-53160

misc: fastrpc: fix use-after-free race in fastrpc_map_create

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: fix use-after-free race in fastrpc_map_create fastrpc_map_lookup returns a raw pointer after releasing fl->lock. The caller fastrpc_map_create then calls fastrpc_map_get (kref_get_unless_zero) on this unprotected pointer. A concurrent MEM_UNMAP can free the map between the lock release and the kref operation, resulting in a use-after-free on the freed slab object. Restore the take_ref parameter to fastrpc_map_lookup so the reference is acquired atomically under fl->lock before the pointer is exposed to the caller.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 0b70ec82b309a4093106ff399da1911ad23b52d3 to < 0a3b87293fbd34fda651e6aead9964f84b893962affected
  • d7513b47082c08105e837b06cebeb3f07a5fa56f to < 8b080c89183196fd3e49212f2a1a1c4a29335b9caffected
  • 802359a52676176b18713e33caa17572ad009057 to < 5b0166112019d1dce30b976ab28fd67f7f0be532affected
  • 10df039834f84a297c72ec962c0f9b7c8c5ca31a to < 992f121796b7ca83a5a8b93da24e971363206218affected
  • 10df039834f84a297c72ec962c0f9b7c8c5ca31a to < f20f6512ecb75c816e0debf4551a138f098615c4affected
  • 10df039834f84a297c72ec962c0f9b7c8c5ca31a to < 07ebe87915d8accdaba20c4f88c5ae430fe62fbbaffected
  • f3f59bab68e9bc714f757ab22f3fb36153014043affected
  • 6.1.156 to < 6.1.176affected
  • 6.6.112 to < 6.6.143affected
  • 6.12.53 to < 6.12.94affected
  • 6.17.3 to < 6.18affected

Linux Linux

Default version status: affected

  • 6.18affected
  • 0 to < 6.18unaffected
  • 6.1.176 to ≤ 6.1.*unaffected
  • 6.6.143 to ≤ 6.6.*unaffected
  • 6.12.94 to ≤ 6.12.*unaffected
  • 6.18.36 to ≤ 6.18.*unaffected
  • 7.0.13 to ≤ 7.0.*unaffected
  • 7.1 to ≤ *unaffected

References