CVE-2026-74646: Linux Kernel Race Condition Vulnerability

CVE-2026-74646 Overview

CVE-2026-74646 is a race condition in the Linux kernel's fastrpc misc driver. The flaw resides in fastrpc_internal_invoke() when an in-flight invoke is interrupted by a signal. In that path, the code moves every buffer from fl->mmaps onto cctx->invoke_interrupted_mmaps without holding fl->lock. That lock serializes all other accessors of fl->mmaps, including fastrpc_req_mmap() and fastrpc_req_munmap(). Concurrent list manipulation can corrupt the linked list and produce undefined kernel state. The upstream fix takes fl->lock around the move, matching every other fl->mmaps accessor.

Critical Impact
A local, authenticated user with access to the fastrpc device can trigger list corruption in kernel memory, enabling potential privilege escalation or denial of service.

Affected Products

Linux kernel misc/fastrpc driver (upstream stable branches prior to the referenced fix commits)
Qualcomm-based platforms exposing /dev/fastrpc-* character devices
Downstream distributions and Android kernels shipping the vulnerable fastrpc driver

Discovery Timeline

2026-08-22 - CVE-2026-74646 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-74646

Vulnerability Analysis

The fastrpc driver implements FastRPC communication with Qualcomm DSPs and maintains a per-file list of memory mappings in fl->mmaps. Access to that list is serialized by fl->lock. When userspace issues an invoke and the calling thread receives a signal, wait_for_completion_interruptible() returns -ERESTARTSYS. The interrupted path in fastrpc_internal_invoke() then walks fl->mmaps and calls list_del() and list_add_tail() to migrate each buffer onto cctx->invoke_interrupted_mmaps. This walk executes without acquiring fl->lock, while fastrpc_req_mmap() and fastrpc_req_munmap() continue to mutate the same list under the lock. The result is a classic locking asymmetry that can corrupt the doubly linked list.

Root Cause

The root cause is a missing lock acquisition on the interrupted-invoke path. Every other accessor of fl->mmaps holds fl->lock, but the signal-interrupted branch does not. This is a Race Condition ([CWE-362]) leading to concurrent modification of a shared kernel linked list.

Attack Vector

Exploitation requires local access and permission to open the fastrpc device node. An attacker issues an invoke, delivers a signal to interrupt the wait, and concurrently issues mmap/munmap ioctls from another thread. The unsynchronized list_del()/list_add_tail() walk can race with the locked mutators, corrupting list pointers. Kernel list corruption can degrade into use-after-free or arbitrary write primitives, which have historically been used for local privilege escalation.

// No verified public exploit code is available for CVE-2026-74646.
// See the upstream fix commits linked in the References section
// for the exact code paths and the patch that adds fl->lock around
// the fl->mmaps to cctx->invoke_interrupted_mmaps migration.

Detection Methods for CVE-2026-74646

Indicators of Compromise

Kernel log entries containing list_del corruption, list_add corruption, or Bad page state originating from fastrpc call paths.
Unexpected oopses or panics referencing fastrpc_internal_invoke, fastrpc_req_mmap, or fastrpc_req_munmap in the backtrace.
Processes repeatedly issuing FastRPC ioctls while sending signals to themselves or sibling threads.

Detection Strategies

Monitor dmesg and /var/log/kern.log for list corruption warnings tied to fastrpc symbols.
Audit workloads accessing /dev/fastrpc-* character devices, since legitimate use is limited to specific DSP client applications.
Correlate signal delivery patterns with FastRPC ioctl bursts from the same process tree.

Monitoring Recommendations

Enable kernel lockdep and CONFIG_DEBUG_LIST in test builds to surface list-integrity violations early.
Ship kernel telemetry and audit logs to a central SIEM so fastrpc-related oopses trigger alerts.
Track running kernel versions across the fleet and flag hosts still on unpatched stable branches.

How to Mitigate CVE-2026-74646

Immediate Actions Required

Apply the upstream stable kernel updates that include the fl->lock fix for fastrpc_internal_invoke().
Restrict permissions on /dev/fastrpc-* nodes to the minimum set of trusted users and service accounts.
Rebuild and redeploy vendor kernels for Qualcomm-based devices once patched sources are available.

Patch Information

The fix is upstream in the Linux kernel and backported across multiple stable branches. Review the referenced commits: Kernel Git Commit a902fe1f, Kernel Git Commit 3f265e40, Kernel Git Commit af634515, Kernel Git Commit b85a0e91, and Kernel Git Commit efd02f8d. The change wraps the fl->mmaps migration in spin_lock/spin_unlock on fl->lock.

Workarounds

If patching is not immediately possible, unload or disable the fastrpc module on systems that do not require DSP offload.
Tighten udev rules so only required services can open fastrpc device nodes.
Restrict container and app sandboxes from mounting or exposing /dev/fastrpc-* to untrusted workloads.

bash

# Configuration example: restrict fastrpc device access and disable module if unused
# 1. Remove world access from fastrpc device nodes via udev
cat >/etc/udev/rules.d/90-fastrpc.rules <<'EOF'
KERNEL=="fastrpc-*", MODE="0660", GROUP="fastrpc"
EOF
udevadm control --reload
udevadm trigger

# 2. Blacklist the module on systems that do not need DSP offload
echo "blacklist fastrpc" >/etc/modprobe.d/blacklist-fastrpc.conf
modprobe -r fastrpc 2>/dev/null || true