CVE-2026-53159: Linux Kernel Privilege Escalation Flaw

CVE-2026-53159 Overview

CVE-2026-53159 is a Linux kernel vulnerability in the fastrpc miscellaneous driver, which handles communication with Qualcomm Digital Signal Processors (DSPs). The flaw resides in fastrpc_get_args(), where the function misuses find_vma() to resolve a user-supplied pointer to a Virtual Memory Area (VMA). When the address falls in a gap before the returned VMA, the offset calculation (ptr & PAGE_MASK) - vma->vm_start underflows, producing a corrupted DMA address that is then dispatched to the DSP. The fix replaces find_vma() with vma_lookup(), which returns NULL when the address is not contained within any VMA.

Critical Impact
A local user supplying a crafted pointer to the fastrpc driver can corrupt the DMA address sent to the DSP, potentially leading to memory corruption, undefined DSP behavior, or denial of service.

Affected Products

Linux kernel misc/fastrpc driver (mainline and stable branches addressed by the referenced commits)
Systems using Qualcomm DSP subsystems exposed via /dev/fastrpc-*
Distributions that ship vulnerable kernel revisions prior to the backported fixes

Discovery Timeline

2026-06-25 - CVE-2026-53159 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-53159

Vulnerability Analysis

The fastrpc driver allows userspace processes to invoke remote procedure calls on Qualcomm DSPs. During argument marshalling, fastrpc_get_args() must translate a user-provided virtual address into a DMA address suitable for the DSP. The original implementation called find_vma() to obtain the VMA covering the pointer.

find_vma() returns the first VMA whose vm_end is greater than the supplied address. This means it can return a VMA that starts after the address, leaving the caller responsible for verifying containment. The fastrpc code skipped that check.

When the user pointer landed in an unmapped gap before the returned VMA, the subtraction (ptr & PAGE_MASK) - vma->vm_start underflowed because vm_start exceeded ptr. The resulting wrapped offset produced a corrupted DMA address that was then handed to the DSP for hardware access.

Root Cause

The root cause is improper input validation combined with misuse of a kernel helper [CWE-20]. find_vma() does not guarantee containment of the queried address, yet the driver treated the returned VMA as if it always wrapped the pointer. The arithmetic relied on this invariant and silently underflowed when it did not hold.

Attack Vector

Exploitation requires local access to a fastrpc device node and the ability to issue ioctl-based RPC requests. An attacker submits an argument pointer that falls in a virtual memory gap immediately preceding a mapped region. The driver computes an incorrect DMA offset and forwards a corrupted physical address to the DSP, which may read or write memory outside the intended buffer. The verified upstream fix replaces find_vma() with vma_lookup(), which returns NULL when no VMA contains the address, allowing the driver to reject the request. See the Kernel Git Commit 464c6ad for the canonical patch.

Detection Methods for CVE-2026-53159

Indicators of Compromise

Unexpected DSP firmware faults, watchdog resets, or remoteproc crash notifications correlated with userspace fastrpc activity
Kernel log entries from the fastrpc subsystem referencing invalid DMA addresses, IOMMU faults, or SMMU context faults
Userspace processes repeatedly invoking fastrpc ioctls with pointers near unmapped virtual memory boundaries

Detection Strategies

Audit running kernel versions across the fleet and compare against the fixed commits referenced in the NVD entry
Monitor dmesg for SMMU/IOMMU fault events that name the fastrpc device or Qualcomm DSP remoteproc instances
Instrument or trace fastrpc_get_args() via ftrace or kprobes in development environments to surface anomalous argument addresses

Monitoring Recommendations

Centralize kernel logs from Linux endpoints running Qualcomm-based silicon and alert on repeated fastrpc or DSP fault patterns
Track ioctl activity against /dev/fastrpc-* device nodes and flag unprivileged processes accessing them
Include kernel CVE feed ingestion in vulnerability management to detect regressions on long-lived Linux images

How to Mitigate CVE-2026-53159

Immediate Actions Required

Identify systems running kernels that include the vulnerable fastrpc_get_args() implementation, particularly Qualcomm-based mobile, automotive, and embedded devices
Apply vendor kernel updates that backport the vma_lookup() replacement referenced in the upstream commits
Restrict access to /dev/fastrpc-* device nodes to trusted system services through filesystem permissions and SELinux policy

Patch Information

The vulnerability is resolved by replacing find_vma() with vma_lookup() in fastrpc_get_args(). Stable backports are available in the following kernel commits: Kernel Git Commit 2d0f47e, Kernel Git Commit 464c6ad, Kernel Git Commit 53e06f8, Kernel Git Commit 708c17b, Kernel Git Commit 7ba7b30, Kernel Git Commit d3e26df, and Kernel Git Commit e69e306.

Workarounds

Disable or unload the fastrpc kernel module on systems that do not require DSP offload functionality
Tighten DAC and MAC permissions on /dev/fastrpc-* so only trusted system daemons can issue ioctls
Constrain unprivileged workloads using seccomp filters that block ioctl calls against fastrpc device file descriptors

bash

# Configuration example
# Restrict access to fastrpc device nodes until kernel is patched
ls -l /dev/fastrpc-*
chown root:system /dev/fastrpc-*
chmod 0660 /dev/fastrpc-*

# Optionally blacklist the module on systems that do not need DSP RPC
echo 'blacklist fastrpc' | sudo tee /etc/modprobe.d/blacklist-fastrpc.conf
sudo update-initramfs -u