Linux Kernel CVE-2026-53159

The fastrpc (Fast Remote Procedure Call) subsystem, implemented under drivers/misc/fastrpc.c in the Linux kernel, provides an interface for offloading compute tasks from a Linux host CPU to a Qualcomm co-processor DSP (Digital Signal Processor) via shared DMA buffers. The vulnerable function fastrpc_get_args() calls find_vma() to resolve a user-supplied virtual address to a kernel VMA (Virtual Memory Area) structure, then computes a DMA offset as (ptr & PAGE_MASK) - vma->vm_start. The documented behavior of find_vma() is to return the first VMA whose end address is greater than the queried address - critically, this means it returns the next VMA even when the address falls in a gap between mapped regions, rather than returning NULL. When a gap-resident address is supplied, the subtraction underflows (unsigned arithmetic wraps to a very large value), and this corrupt offset is forwarded to the DSP as a DMA address. The fix replaces find_vma() with vma_lookup(), which returns NULL for addresses not contained within any VMA, allowing the caller to reject invalid inputs. Root cause is an integer underflow / incorrect pointer arithmetic (analogous to CWE-191 and CWE-682); no CWE was assigned by NVD. Affected CPE: cpe:2.3:o:linux:linux_kernel.