CVE-2026-53160: Linux Kernel Use-After-Free Vulnerability

CVE-2026-53160 Overview

CVE-2026-53160 is a use-after-free race condition in the Linux kernel's misc/fastrpc driver, specifically in the fastrpc_map_create code path. The function fastrpc_map_lookup returns a raw pointer after releasing the fl->lock spinlock, leaving a window where a concurrent MEM_UNMAP operation can free the map object. When the caller subsequently invokes fastrpc_map_get (kref_get_unless_zero) on the now-freed slab object, the kernel operates on freed memory. The flaw was resolved by restoring the take_ref parameter to fastrpc_map_lookup, ensuring the reference is acquired atomically under fl->lock before exposure to the caller.

Critical Impact
A local attacker with access to the FastRPC device interface can trigger a use-after-free on a kernel slab object, potentially leading to memory corruption, denial of service, or local privilege escalation.

Affected Products

Linux kernel versions containing the misc: fastrpc driver prior to the fix commits listed in the kernel.org stable tree
Systems using Qualcomm FastRPC subsystem for DSP communication (typical on ARM64 mobile and embedded platforms)
Multiple stable kernel branches receiving backports (six fix commits referenced)

Discovery Timeline

2026-06-25 - CVE CVE-2026-53160 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-53160

Vulnerability Analysis

The vulnerability resides in the FastRPC misc driver, which mediates communication between user space and Qualcomm DSP subsystems. The fastrpc_map_create function uses fastrpc_map_lookup to find an existing memory map matching a user-supplied descriptor. The lookup function acquires the per-file-descriptor lock fl->lock, walks the map list, and returns a pointer to a matching map after releasing the lock.

Between the lock release and the caller's invocation of fastrpc_map_get, another thread issuing a FASTRPC_IOCTL_MEM_UNMAP ioctl can decrement the map's reference count to zero and free the underlying slab allocation. The subsequent kref_get_unless_zero then dereferences freed memory, classifying the issue as a Use-After-Free [CWE-416] driven by a race condition [CWE-362].

Root Cause

The root cause is a Time-of-Check to Time-of-Use (TOCTOU) gap. Reference acquisition is not atomic with the lookup. The original code split the lookup and reference-increment operations across the critical section boundary, exposing the map pointer outside the lock's protection.

Attack Vector

Exploitation requires local access to the /dev/fastrpc-* device node. An attacker runs two concurrent threads: one repeatedly invoking the map creation path and another issuing MEM_UNMAP calls against the same map identifier. Winning the race causes the kernel to operate on a freed struct fastrpc_map, enabling heap manipulation primitives common to slab-based privilege escalation techniques.

No public proof-of-concept code is currently available. The vulnerability mechanism is documented in the upstream patch commits on git.kernel.org. See the Kernel Git Commit Change for the canonical fix and additional backport commits for stable trees.

Detection Methods for CVE-2026-53160

Indicators of Compromise

Kernel log entries referencing slab corruption, KASAN: use-after-free, or general protection faults within fastrpc_map_create or fastrpc_map_get
Unexpected oops or panic events on systems exposing /dev/fastrpc-* device nodes to unprivileged users
Processes repeatedly invoking FASTRPC_IOCTL_MMAP and FASTRPC_IOCTL_MEM_UNMAP ioctls in tight loops from the same file descriptor

Detection Strategies

Enable CONFIG_KASAN on test and staging kernels to catch use-after-free conditions during fuzzing or stress testing of the FastRPC interface
Audit auditd rules for ioctl syscalls targeting FastRPC device nodes and flag unusual concurrent access patterns from a single PID group
Monitor for kernel crash signatures and core dumps that point to drivers/misc/fastrpc.c call stacks

Monitoring Recommendations

Track kernel version inventory across Linux endpoints to identify hosts running unpatched stable branches
Alert on access to /dev/fastrpc-* from non-privileged or non-system user contexts where DSP usage is not expected
Forward kernel ring buffer events (dmesg, journalctl -k) to a centralized log platform for anomaly review

How to Mitigate CVE-2026-53160

Immediate Actions Required

Apply the upstream patch series referenced by commits 07ebe87915d8, 0a3b87293fbd, 5b0166112019, 8b080c891831, 992f121796b7, and f20f6512ecb7 from kernel.org
Update to a vendor kernel build that includes the FastRPC use-after-free fix on affected stable branches
Restrict access to /dev/fastrpc-* device nodes to trusted system services via udev rules and group permissions

Patch Information

The fix restores the take_ref parameter to fastrpc_map_lookup, ensuring the reference count is incremented atomically under fl->lock before the pointer is returned. Patches are available in the kernel.org stable tree. Reference the Kernel Git Commit Change and the additional backport commits at 992f121796b7 and f20f6512ecb7.

Workarounds

On systems that do not require DSP offload, unload or blacklist the fastrpc kernel module to remove the attack surface
Tighten permissions on FastRPC device nodes so only privileged daemons can issue ioctls, reducing exposure from unprivileged local users
Deploy seccomp filters in untrusted applications to block ioctl calls against FastRPC file descriptors

bash

# Configuration example: blacklist the fastrpc module where not required
echo 'blacklist fastrpc' | sudo tee /etc/modprobe.d/blacklist-fastrpc.conf
sudo rmmod fastrpc 2>/dev/null || true

# Restrict device node permissions via udev
cat <<'EOF' | sudo tee /etc/udev/rules.d/90-fastrpc.rules
KERNEL=="fastrpc-*", MODE="0600", OWNER="root", GROUP="root"
EOF
sudo udevadm control --reload-rules && sudo udevadm trigger