CVE-2026-74647: Linux Kernel Race Condition Vulnerability

CVE-2026-74647 Overview

CVE-2026-74647 is a race condition vulnerability in the Linux kernel's fastrpc misc driver, which handles communication with the Qualcomm Digital Signal Processor (DSP). The flaw resides in the fastrpc_req_munmap_impl() function, where a mapped buffer is removed from the internal tracking list only after the DSP unmap operation completes. Concurrent unmap requests from multiple threads can therefore operate on the same buffer entry, producing a time-of-check to time-of-use (TOCTOU) style race.

Critical Impact
Local attackers with access to the fastrpc device interface can trigger concurrent unmap operations to corrupt kernel memory state, potentially escalating privileges on affected Linux systems using Qualcomm DSP hardware.

Affected Products

Linux kernel misc/fastrpc driver (Qualcomm FastRPC)
Linux distributions shipping vulnerable kernel versions with Qualcomm DSP support
Embedded and mobile systems using Qualcomm SoCs with fastrpc enabled

Discovery Timeline

2026-08-22 - CVE-2026-74647 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-74647

Vulnerability Analysis

The fastrpc driver provides userspace access to Qualcomm DSP compute offload. Userspace programs invoke ioctl operations to allocate, map, and unmap buffers shared with the DSP. When fastrpc_req_munmap_impl() was invoked, the driver first issued the DSP-side unmap operation and only then removed the buffer entry from the driver's tracked buffer list.

This ordering creates a window where two threads can enter the unmap path with references to the same list entry. One thread proceeds through the DSP unmap while a second thread observes the still-present list entry and initiates a parallel unmap, resulting in double-free style memory corruption or use-after-free conditions in kernel memory.

Exploitation requires only local access and low privileges typical of any process able to open the fastrpc character device. Successful exploitation impacts confidentiality, integrity, and availability of the kernel.

Root Cause

The root cause is incorrect ordering of list manipulation relative to the unmap operation. The buffer entry remained visible on the shared list throughout the DSP unmap, allowing concurrent lookup and removal by other threads. This is a classic race condition [CWE-362] in kernel resource lifecycle management.

The upstream fix removes the buffer entry from the list before calling the unmap operation. If the DSP-side unmap fails, the entry is re-added so userspace can retry. Otherwise, any residual buffers are cleaned up when the DSP process is torn down at device release.

Attack Vector

An unprivileged local user with fastrpc device access spawns multiple threads that invoke the unmap ioctl against the same buffer identifier. By racing these calls, the attacker triggers concurrent execution of fastrpc_req_munmap_impl() on a shared list entry. The resulting kernel memory corruption can be shaped into arbitrary write primitives to achieve privilege escalation. No user interaction is required.

See the upstream Linux kernel commit for the fastrpc fix for the exact code change.

Detection Methods for CVE-2026-74647

Indicators of Compromise

Kernel oops, panic, or KASAN reports referencing fastrpc_req_munmap_impl or fastrpc_buf_free in call traces
Unexpected SIGKILL or crash of processes holding /dev/fastrpc-* handles
Slab corruption warnings tied to the fastrpc allocation caches in dmesg
Kernel logs showing DSP unmap failures accompanied by list corruption warnings such as list_del corruption

Detection Strategies

Enable CONFIG_KASAN and CONFIG_DEBUG_LIST on test and staging kernels to surface use-after-free and list corruption at the point of failure
Audit process access to /dev/fastrpc-* device nodes and alert on unexpected openers outside of known DSP client applications
Correlate kernel crash telemetry with recent ioctl sequences issued against fastrpc devices

Monitoring Recommendations

Collect kernel ring buffer output via journald or a syslog forwarder and search for fastrpc symbols in oops traces
Monitor process creation for unprivileged binaries invoking multiple concurrent threads against fastrpc device nodes
Track kernel version and patch status across Linux endpoints to identify systems still exposed to CVE-2026-74647

How to Mitigate CVE-2026-74647

Immediate Actions Required

Apply the stable kernel updates containing the fastrpc list-ordering fix from kernel.org
Inventory systems using Qualcomm DSP hardware where the fastrpc driver is loaded
Restrict access to /dev/fastrpc-* device nodes to trusted user groups only
Prioritize patching mobile, IoT, and embedded devices running on Qualcomm SoCs

Patch Information

The fix is present in multiple stable branches. Reference commits include 0beaa9bd7eb1, 1edb654b2b41, 4716c23c206a, 6102ceb4eab8, 97273624f7b3, 99f8de36c84c, 9bf22a7d950c, and fe7032905597. Rebuild and deploy kernels from a stable branch that includes one of these commits.

Workarounds

Unload the fastrpc kernel module on systems that do not require DSP offload using rmmod fastrpc
Tighten permissions on /dev/fastrpc-* via udev rules so only privileged service accounts can open the device
Use Linux Security Modules such as SELinux or AppArmor to constrain which processes may issue ioctl calls to fastrpc

bash

# Restrict access to fastrpc device nodes via udev
# /etc/udev/rules.d/90-fastrpc.rules
KERNEL=="fastrpc-*", MODE="0600", OWNER="root", GROUP="root"

# Reload rules and verify
sudo udevadm control --reload-rules
sudo udevadm trigger
ls -l /dev/fastrpc-*