CVE-2026-53161: Linux fastrpc Use-After-Free Privilege Escalation

Technical summary

The vulnerability stems from improper synchronization between the fastrpc_device_release() function, which executes when a user closes a file descriptor, and the workqueue that processes asynchronous DSP responses. When fastrpc_device_release() frees the fastrpc_user structure, concurrent or subsequent execution of fastrpc_context_free() via a scheduled work item can dereference the already-freed pointer. The race manifests in three distinct code paths: (1) fastrpc_buf_free() dereferencing buf->fl->cctx for IOVA address translation, (2) fastrpc_free_map() reading map->fl->cctx->vmperms to reconstruct memory permissions for SCM calls, and (3) fastrpc_free_map() acquiring map->fl->lock to safely remove map nodes. The fix introduces reference counting (kref) on the fastrpc_user structure. Each invoke context takes a reference at allocation; contexts release their reference upon completion. The initial reference is released at device close, but the actual teardown of user resources is deferred to the kref release callback, fastrpc_user_free(), which executes only when the final reference drops.

Business impact

Systems using Qualcomm-based processors with fastrpc functionality—including snapdragon-based devices, automotive platforms, and IoT endpoints—face stability and security risks. A local unprivileged attacker could trigger kernel memory corruption, leading to denial of service or privilege escalation. Multi-user systems and cloud environments with guest isolation relying on kernel integrity are particularly exposed. The impact depends on whether the fastrpc driver is compiled and active in the target kernel; many standard deployments on Qualcomm hardware will be affected.

Affected systems

The vulnerability affects the Linux kernel fastrpc driver across multiple versions. Qualcomm-based systems including Snapdragon processors, automotive and industrial IoT platforms, and Android devices running affected kernel versions are in scope. The vulnerability requires the fastrpc driver to be compiled and accessible, which is common in Qualcomm SoC deployments but not universal across all Linux distributions. Desktop and server platforms without Qualcomm hardware or fastrpc driver support are not affected.

Exploitability

Exploitation requires local access and unprivileged user-level privileges (no root needed), making the barrier to entry relatively low on systems with local user accounts. However, reliable exploitation depends on precise timing of the race condition—closing a file descriptor while DSP responses are in-flight. The vulnerability is not remotely exploitable. The inconsistent nature of race conditions means success may require multiple attempts or specific workload conditions, though the kernel crash manifestation suggests the flaw is highly likely to be triggered under concurrent DSP usage patterns.

Remediation

Apply a kernel update that includes the reference-counting fix to fastrpc_user structures and defers teardown to the kref release callback. Verify the patch is included in the vendor's advisory. As a temporary mitigation, disable the fastrpc driver via kernel configuration or module blacklist if not required for your use case. Limit local user account creation and enforce strict access controls on systems that must run the vulnerable driver until patching is complete.

Patch guidance

Consult your Linux distribution and hardware vendor's security advisory for availability and timing of patched kernel versions. Qualcomm and your distribution maintainer will provide specific kernel versions containing the fix—verify the fastrpc reference-counting changes are present before deployment. Test the patch in a non-production environment first, as kernel updates require reboot. For systems unable to update immediately, consider disabling fastrpc via grub parameters or module configuration files as a temporary protective measure.

Detection guidance

Monitor system logs for kernel oops or panic messages originating from the fastrpc driver, particularly stack traces mentioning fastrpc_context_free(), fastrpc_buf_free(), or fastrpc_free_map(). Kernel address sanitizer (KASAN) or other memory safety tools, if enabled, will detect the use-after-free at runtime. Workqueue activity and file descriptor close operations on fastrpc devices can be logged via audit rules. Detection of exploitation in production is challenging due to the race condition's unpredictable nature; prevention through timely patching is the most reliable defense.

Why prioritize this

A CVSS 7.8 HIGH-severity local privilege escalation and denial of service flaw targeting kernel memory safety warrants prompt remediation. While not remotely exploitable, the low privilege requirement and presence on Qualcomm hardware—a significant installed base—justifies prioritization. Kernel stability issues carry cascading business impact; organizations operating affected Qualcomm-based infrastructure should schedule patching within their standard critical kernel update timelines.

Risk score, explained

The CVSS 3.1 score of 7.8 reflects: (1) local attack vector—exploiter needs shell access; (2) low complexity—the race condition, while timing-sensitive, is triggered by normal close+DSP activity patterns; (3) low privilege requirement—unprivileged users can trigger the flaw; (4) high confidentiality, integrity, and availability impact—kernel memory corruption enables privilege escalation and system crash. The score appropriately signals a serious local kernel vulnerability requiring near-term remediation.

Frequently asked questions