CVE-2026-53161

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context<br /> <br /> There is a race between fastrpc_device_release() and the workqueue<br /> that processes DSP responses. When the user closes the file descriptor,<br /> fastrpc_device_release() frees the fastrpc_user structure. Concurrently,<br /> an in-flight DSP invocation can complete and fastrpc_rpmsg_callback()<br /> schedules context cleanup via schedule_work(&amp;ctx-&gt;put_work). If the<br /> workqueue runs fastrpc_context_free() in parallel with or after<br /> fastrpc_device_release() has freed the user structure, it dereferences<br /> the freed fastrpc_user. Depending on the state of the context at the<br /> time of the race, any one of the following accesses can be hit:<br /> <br /> 1. fastrpc_buf_free() calls fastrpc_ipa_to_dma_addr(buf-&gt;fl-&gt;cctx, ...)<br /> to strip the SID bits from the stored IOVA before passing the<br /> physical address to dma_free_coherent().<br /> <br /> 2. fastrpc_free_map() reads map-&gt;fl-&gt;cctx-&gt;vmperms[0].vmid to<br /> reconstruct the source permission bitmask needed for the<br /> qcom_scm_assign_mem() call that returns memory from the DSP VM<br /> back to HLOS.<br /> <br /> 3. fastrpc_free_map() acquires map-&gt;fl-&gt;lock to safely remove the<br /> map node from the fl-&gt;maps list.<br /> <br /> The resulting use-after-free manifests as:<br /> <br /> pc : fastrpc_buf_free+0x38/0x80 [fastrpc]<br /> lr : fastrpc_context_free+0xa8/0x1b0 [fastrpc]<br /> fastrpc_context_free+0xa8/0x1b0 [fastrpc]<br /> fastrpc_context_put_wq+0x78/0xa0 [fastrpc]<br /> process_one_work+0x180/0x450<br /> worker_thread+0x26c/0x388<br /> <br /> Add kref-based reference counting to fastrpc_user. Have each invoke<br /> context take a reference on the user at allocation time and release it<br /> when the context is freed. Release the initial reference in<br /> fastrpc_device_release() at file close. Move the teardown of the user<br /> structure — freeing pending contexts, maps, mmaps, and the channel<br /> context reference — into the kref release callback fastrpc_user_free(),<br /> so that it runs only when the last reference is dropped, regardless of<br /> whether that happens at device close or after the final in-flight<br /> context completes.