CVE-2026-53160: Linux Kernel fastrpc Use-After-Free Race Condition (CVSS 7.8)

Technical summary

CVE-2026-53160 is a use-after-free (CWE-416) in the Linux kernel's fastrpc miscellaneous driver. The fastrpc_map_lookup function returns a raw pointer after releasing fl->lock. The caller, fastrpc_map_create, then invokes fastrpc_map_get (which calls kref_get_unless_zero) on this unprotected pointer. A concurrent MEM_UNMAP operation can deallocate the map object between the lock release and the subsequent kref operation, resulting in the caller dereferencing freed memory. The fix restores a take_ref parameter to fastrpc_map_lookup, allowing the reference to be acquired atomically while fl->lock is held, ensuring the pointer remains valid when exposed to the caller.

Business impact

This vulnerability allows a local attacker to destabilize systems running affected kernel versions. Exploitation can cause kernel panics, system unavailability, or in worst-case scenarios, privilege escalation. Organizations running Linux on edge devices, IoT platforms, or systems where local access is feasible should prioritize remediation to maintain availability and prevent potential lateral movement within their infrastructure.

Affected systems

The Linux kernel across multiple versions is affected. The exact range of impacted kernel versions is not specified in the CVE record; consult the Linux vendor security advisory or your distribution's (Red Hat, Debian, Ubuntu, etc.) CVE tracking page to identify which kernel releases in your environment require patching.

Exploitability

Exploitation requires local system access (CVSS:3.1/AV:L) and no elevated privileges beyond a standard user (PR:L). No user interaction is needed. The attack relies on precise timing to create the race condition. While not as straightforward as some remote exploits, the low attack complexity (AC:L) and local-only requirement make this realistic for multi-user systems or systems where attackers have established a foothold. Exploitation is not yet known to be in the wild (KEV status: false).

Remediation

Apply a kernel update that includes the fastrpc race condition fix. The resolution involves modifying fastrpc_map_lookup to accept and honor a take_ref parameter, ensuring reference counting is performed atomically under lock. Contact your Linux distribution (Red Hat, Debian, Ubuntu, SUSE, etc.) for patched kernel versions or check kernel.org for the upstream fix commit.

Patch guidance

Obtain the latest stable kernel update from your distribution's security channel or from kernel.org. Verify the update includes the fastrpc fix by cross-referencing the commit hash or changelog. Test in a non-production environment before deploying to production systems. Plan a maintenance window for kernel updates that require a reboot. If immediate patching is not feasible, consider restricting local system access or running the system with reduced privileges where operationally possible.

Detection guidance

Monitor kernel logs and crash dumps for fastrpc-related oops messages, use-after-free warnings, or KASAN (Kernel Address Sanitizer) reports mentioning fastrpc map operations. Intrusion detection systems should alert on unusual patterns of concurrent fastrpc MEM_UNMAP and map_create calls from the same process. On systems with SELinux or AppArmor, review logs for denials related to fastrpc device access. Kernel debuggers or tracing tools (perf, ftrace) can help identify suspicious timing patterns in fastrpc operations.

Why prioritize this

Although not yet publicly exploited (KEV status: false), the vulnerability carries a CVSS score of 7.8 (HIGH) due to its impact on confidentiality, integrity, and availability combined with low attack complexity and local access. Systems with untrusted local users or shared hosting environments face elevated risk. Prioritize patches for production systems, especially those running older kernel versions that may lag behind security releases.

Risk score, explained

The CVSS:3.1 score of 7.8 (HIGH) reflects: local attack vector (AV:L), low attack complexity (AC:L), low privilege requirement (PR:L), and high impact across confidentiality, integrity, and availability (C:H/I:H/A:H). The race condition is achievable without elevated privileges but requires local system access. The high impact rating acknowledges that successful exploitation can lead to kernel compromise, data exfiltration, or system denial of service.

Frequently asked questions