CVE-2026-53158: Linux Kernel fastrpc NULL Pointer Dereference – Snapdragon Devices

Technical summary

The vulnerability exists in the fastrpc rpmsg callback mechanism within the Linux kernel. Two initialization-ordering issues combine to create a race condition: (1) dev_set_drvdata() is called before internal spinlocks and IDR structures are initialized, creating a window where the callback can retrieve a valid context pointer but operate on uninitialized synchronization primitives; (2) the rpmsg channel becomes active immediately upon driver binding, potentially firing callbacks before dev_set_drvdata() is invoked, resulting in NULL pointer dereference at offset 0x178 (the spinlock field in fastrpc_channel_ctx). The fix involves reordering initialization to complete all struct setup before making the context visible to callbacks, plus adding defensive NULL checks in the callback handler.

Business impact

Systems relying on Qualcomm DSP acceleration (common in mobile and edge computing) may experience unexpected reboots or denial of service during boot on affected platforms. For organizations using Snapdragon-based devices in production environments, this could impact service availability. The local nature of the vulnerability limits exposure to privileged or local users, but unprivileged triggering via DSP message timing makes it a stability concern for any system running the affected kernel.

Affected systems

The vulnerability affects the Linux kernel fastrpc driver, primarily impacting Qualcomm Snapdragon platforms (such as Hawi mentioned in the report). Any system running a vulnerable kernel version with the fastrpc driver enabled and Qualcomm GLINK messaging active is potentially affected. This includes mobile devices, IoT platforms, and edge compute nodes using Snapdragon processors. Verify your kernel version against the official Linux kernel security advisories for the specific affected version range.

Exploitability

Exploitability is limited by several factors: the vulnerability requires local system access (CVSS AV:L), cannot be triggered remotely, and does not allow privilege escalation or information disclosure. However, the timing-dependent race condition can be triggered naturally during system boot as the DSP firmware initializes, making it a reliability issue rather than requiring deliberate exploit action. A local user cannot easily weaponize this for unauthorized access, but the denial of service impact during boot affects all users of the system.

Remediation

The Linux kernel project has resolved this vulnerability by reordering the fastrpc_rpmsg_probe() initialization sequence to complete all struct setup (spinlock and IDR initialization) before calling dev_set_drvdata(), and by adding NULL pointer validation in fastrpc_rpmsg_callback(). Affected systems require a kernel update to a patched version. Verify the specific patched kernel version from the official Linux kernel security advisory or your distribution's security updates.

Patch guidance

Apply the latest kernel security updates from your Linux distribution. For Qualcomm Snapdragon-based systems, ensure the fastrpc driver initialization patch is included. Coordinate with your device manufacturer if running vendor-customized kernels, as backport timing varies. Test kernel updates on non-production systems first, particularly for devices relying on DSP functionality. Kernel updates typically require system reboot.

Detection guidance

Monitor system logs for NULL pointer dereference crashes (kernel panic traces mentioning fastrpc_rpmsg_callback or _raw_spin_lock_irqsave in the fastrpc module). Boot-time failures or intermittent reboots on Snapdragon devices are potential indicators. Check kernel version via 'uname -r' and cross-reference against patched versions in kernel security advisories. Reproduction is difficult without triggering specific DSP timing; focus on verifying patch application rather than active testing.

Why prioritize this

While CVSS scores this as MEDIUM severity (5.5), the vulnerability should be prioritized for systems relying on Snapdragon-based devices in production. The boot-time nature and local-only exposure lower the immediate threat, but potential service interruption justifies timely patching. Organizations running mobile infrastructure, IoT fleets, or edge compute nodes should prioritize kernel updates. This is lower priority for server-only deployments without Snapdragon hardware.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) reflects the local-only attack surface (AV:L), low complexity (AC:L), requirement for local privileges (PR:L), and lack of confidentiality or integrity impact (C:N/I:N). The availability impact is high (A:H) due to kernel crash potential. The score appropriately captures that this is a local stability issue rather than a remote or privilege-escalation vector, though the practical impact on boot reliability justifies aggressive patching timelines for affected hardware platforms.

Frequently asked questions