CVE-2026-53159: Linux Kernel fastrpc DMA Address Corruption Vulnerability

Technical summary

The vulnerability resides in fastrpc_get_args(), which uses find_vma() to locate the virtual memory area (VMA) associated with a user-provided pointer and derive a DMA offset. The find_vma() function returns the lowest VMA whose end address is greater than or equal to the target address—meaning it can return a VMA that does not actually contain the address if the address falls in a gap before that VMA. When this occurs, the calculation (ptr & PAGE_MASK) - vma->vm_start underflows, resulting in an invalid DMA address. An attacker can exploit this by supplying an address in such a gap, causing corrupted DMA pointers to be transmitted to the DSP. The remediation replaces find_vma() with vma_lookup(), which returns NULL if the address is not contained within any VMA, allowing the driver to properly reject invalid pointers.

Business impact

Successful exploitation permits a local, authenticated user to corrupt memory-mapped operations between the kernel and DSP firmware. This can lead to unauthorized privilege escalation, bypassing security controls, or causing denial of service through DSP malfunction. Systems relying on fastrpc for offloading computational tasks (common in mobile and embedded devices using Qualcomm processors) face elevated risk of lateral movement and persistent compromise. Remediation is critical for systems where DSP access is a security boundary or where privilege separation is enforced.

Affected systems

All versions of the Linux kernel incorporating the fastrpc misc driver are affected. The vulnerability impacts systems with Qualcomm Snapdragon processors or compatible DSP hardware that use the kernel's fastrpc interface for user-to-DSP communication. Primary targets include Android devices, IoT appliances, and embedded systems running affected kernel versions. Determine your specific kernel version and whether CONFIG_MSM_FASTRPC is enabled in your build configuration.

Exploitability

This vulnerability requires local code execution with unprivileged user privileges—no special capabilities or kernel-level access needed. An attacker must craft a malicious pointer in a memory gap and invoke fastrpc operations, which is feasible for any process running on the target system. The attack is deterministic and does not require race conditions or timing. However, practical exploitation depends on the DSP's security model and what operations the attacker can trigger; not all systems may expose exploitable DSP functionality to unprivileged users. The ease of triggering the underlying flaw is high, but end-to-end impact varies by system configuration.

Remediation

Apply the Linux kernel patch that replaces find_vma() with vma_lookup() in the fastrpc_get_args() function. This function will now return NULL for addresses not contained within a valid VMA, enabling the driver to reject malicious or out-of-bounds pointers before they reach the DSP. Verify the patch against your kernel version and distribution; timing of availability depends on your kernel maintenance stream (mainline, stable, or vendor-specific). Test patches in a controlled environment before production deployment.

Patch guidance

Identify your running kernel version (uname -r) and check whether the fastrpc driver is built into your system (grep CONFIG_MSM_FASTRPC /boot/config-$(uname -r)). If enabled, obtain the patched kernel from your vendor (e.g., Linux kernel stable releases, Android Security & Maintenance Releases for mobile devices, or your enterprise Linux distributor). Verify the patch commit resolves the CVE and matches the upstream fix. Recompile and test the kernel or install a pre-built image, then reboot to activate the patch. Monitor kernel changelogs and security advisories for your specific distribution to ensure timely deployment.

Detection guidance

Monitor system logs for failed fastrpc operations or unusual DSP error messages that might indicate exploitation attempts. If available, enable kernel security auditing (via auditd) to log fastrpc ioctl calls and track which processes invoke the affected code path. Inspect /proc/config.gz or /boot/config-* to confirm CONFIG_MSM_FASTRPC status and kernel version. For Android devices, cross-reference your security patch level against Google's Android Security & Maintenance Releases. Forensic analysis of a potentially compromised system should examine DSP firmware state and inter-processor communication logs for anomalies.

Why prioritize this

With a CVSS score of 8.8 (HIGH severity), this vulnerability combines local attack vector with high confidentiality, integrity, and availability impact across system boundaries. The ease of triggering the underlying code path and the potential for privilege escalation make this a significant risk for multi-user or untrusted-code environments. Systems handling sensitive workloads on DSP processors or those with weak privilege separation should prioritize patching. Conversely, single-user or fully controlled environments may have lower urgency if DSP operations are restricted.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects: (1) local attack vector—requires shell or unprivileged process execution; (2) low attack complexity—no special conditions or race conditions needed; (3) low privileges required—any non-root user can trigger the flaw; (4) no user interaction needed; (5) changed scope—impact extends beyond the fastrpc driver to the DSP and potentially other system components; (6) high confidentiality impact—corrupted DMA can leak sensitive data; (7) high integrity impact—arbitrary DSP memory or state modification; (8) high availability impact—DSP malfunction or system instability. The scope change (from fastrpc isolation to system-wide impact) and privilege escalation potential elevate the score to HIGH.

Frequently asked questions