CVE-2026-53161: Linux Kernel Use-After-Free Vulnerability

CVE-2026-53161 Overview

CVE-2026-53161 is a use-after-free vulnerability in the Linux kernel's fastrpc misc driver, which mediates remote procedure calls to Qualcomm Digital Signal Processors (DSPs). A race condition exists between fastrpc_device_release() and the workqueue that processes DSP responses. When a user closes the file descriptor, the fastrpc_user structure is freed while an in-flight DSP invocation can still complete and trigger fastrpc_rpmsg_callback(), which schedules context cleanup via schedule_work(&ctx->put_work). If the workqueue runs fastrpc_context_free() after the user structure has been freed, it dereferences freed memory.

Critical Impact
Concurrent execution of file-descriptor release and the DSP response workqueue can dereference freed kernel memory, leading to kernel memory corruption and potential local privilege escalation on systems exposing the fastrpc device.

Affected Products

Linux kernel misc/fastrpc driver (Qualcomm DSP fastrpc subsystem)
Kernel branches prior to the commits referenced in stable trees
Systems exposing /dev/fastrpc-* to user space, primarily Qualcomm SoC-based platforms

Discovery Timeline

2026-06-25 - CVE-2026-53161 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-53161

Vulnerability Analysis

The fastrpc driver tracks per-file-descriptor state in a fastrpc_user structure. Each user-issued DSP invocation creates an invoke context that holds a back-pointer to the owning fastrpc_user. When the DSP returns a response, fastrpc_rpmsg_callback() defers context cleanup to a workqueue using schedule_work(&ctx->put_work). Closing the descriptor invokes fastrpc_device_release(), which previously freed the fastrpc_user immediately. Because workqueue execution is asynchronous, the cleanup worker can run after the user structure has been freed.

The resulting use-after-free can manifest in several call sites: fastrpc_buf_free() dereferences buf->fl->cctx to translate IOVAs before calling dma_free_coherent(); fastrpc_free_map() reads map->fl->cctx->vmperms[0].vmid to rebuild permission bitmasks for qcom_scm_assign_mem(); and fastrpc_free_map() also acquires map->fl->lock to remove map nodes. Each access touches memory that may already be reclaimed.

Root Cause

The root cause is missing reference counting on fastrpc_user. The driver assumed fastrpc_device_release() was the sole owner of the lifetime, but in-flight contexts held raw pointers without taking a reference. This is a classic [CWE-416] use-after-free arising from a [CWE-362] race between a release path and an asynchronous workqueue.

Attack Vector

A local user with access to the fastrpc device node can race file-descriptor close against pending DSP responses. By submitting invocations and then closing the descriptor before contexts complete, the user can trigger the cleanup worker to dereference the freed fastrpc_user. Exploitation requires local access and the ability to interact with the fastrpc character device. No verified public proof-of-concept is available for this issue.

// No verified exploit code is available. The vulnerable sequence is:
// 1. Process opens /dev/fastrpc-* -> allocates fastrpc_user (fl)
// 2. Process issues invocation -> ctx->fl = fl
// 3. DSP responds -> fastrpc_rpmsg_callback() -> schedule_work(&ctx->put_work)
// 4. Process closes fd -> fastrpc_device_release() frees fl
// 5. Workqueue runs fastrpc_context_free() -> dereferences freed fl (UAF)

Detection Methods for CVE-2026-53161

Indicators of Compromise

Kernel oops or panic with call traces containing fastrpc_buf_free, fastrpc_context_free, fastrpc_context_put_wq, or process_one_work frames
KASAN reports flagging use-after-free reads in the fastrpc module
Unexpected crashes correlated with processes closing /dev/fastrpc-* descriptors while DSP invocations are outstanding

Detection Strategies

Enable CONFIG_KASAN on test and pre-production kernels to surface the use-after-free deterministically during fastrpc workloads
Audit installed kernel package versions against the fixed commits listed in the kernel.org stable tree
Monitor kernel logs for repeated faults inside the fastrpc module after user-space DSP clients exit

Monitoring Recommendations

Forward dmesg and /var/log/kern.log to a centralized log pipeline and alert on any fastrpc-related oops or KASAN signature
Track process exits that hold open fastrpc descriptors and correlate with subsequent kernel warnings
Inventory devices exposing fastrpc nodes (typically Qualcomm SoC platforms) and prioritize them for patch verification

How to Mitigate CVE-2026-53161

Immediate Actions Required

Apply the upstream Linux kernel patches that introduce kref-based reference counting on fastrpc_user and move teardown into fastrpc_user_free()
Update to a vendor kernel build that includes the referenced stable commits for the affected branches
Restrict access to /dev/fastrpc-* device nodes to trusted users and services only

Patch Information

The fix adds kref reference counting to fastrpc_user. Each invoke context takes a reference at allocation and releases it on free. fastrpc_device_release() drops the initial reference; teardown of pending contexts, maps, mmaps, and the channel context reference is moved into the kref release callback fastrpc_user_free(). This guarantees teardown runs only after the last in-flight context completes. Fix commits are published in the kernel stable tree, including commit d42679eef34d, commit 5278ccd357e0, and commit fbe0947420ee.

Workarounds

Tighten permissions on fastrpc device nodes via udev so only required service accounts can open them
Disable or unload the fastrpc module on systems that do not require DSP offload functionality
Where DSP functionality is mandatory, isolate fastrpc-using workloads from untrusted local users via sandboxing or MAC policy (SELinux, AppArmor)

bash

# Restrict access to fastrpc device nodes via udev
# /etc/udev/rules.d/99-fastrpc.rules
KERNEL=="fastrpc-*", MODE="0600", OWNER="root", GROUP="root"

# Or unload the module on systems that do not need DSP offload
sudo modprobe -r fastrpc
echo "blacklist fastrpc" | sudo tee /etc/modprobe.d/blacklist-fastrpc.conf