EUVD-2026-64584
GHSA-4jph-32qw-h3gw
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Race condition requires precise thread scheduling timing (AC:H); local access with low privileges to open fastrpc device node (AV:L/PR:L); no scope change, full kernel memory impact.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
misc: fastrpc: Remove buffer from list prior to unmap operation
fastrpc_req_munmap_impl() is called to unmap any buffer. The buffer is getting removed from the list after it is unmapped from DSP. This can create potential race conditions if multiple threads invoke unmap concurrently, where one thread may remove the entry from the list while another thread's unmap operation is still ongoing.
Fix this by removing the buffer entry from the list before calling the unmap operation. If the unmap fails, the entry is re-added to the list so that userspace can retry the unmap, or alternatively, the buffer will be cleaned up during device release when the DSP process is torn down and all DSP-side mappings are freed along with remaining buffers in the list.
AnalysisAI
Race condition in the Linux kernel fastrpc driver allows a local low-privileged attacker on Qualcomm DSP-equipped systems to trigger a use-after-free condition by issuing concurrent munmap ioctls, potentially achieving kernel memory corruption and privilege escalation. The flaw exists in fastrpc_req_munmap_impl() where the internal buffer list is updated only after the DSP unmap completes, leaving a window in which a concurrent thread can operate on an already-unmapped entry. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local code execution with at minimum low-privilege access (PR:L per CVSS) on a Linux system where the fastrpc driver is loaded and the fastrpc device node (e.g., `/dev/fastrpc-adsp` or `/dev/fastrpc-cdsp`) is accessible to the attacking process. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects local exploitation with low privileges yielding full kernel impact, which is plausible for a successful use-after-free exploit. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a local shell at low privilege on a Qualcomm Snapdragon-based Linux device opens the fastrpc device node, maps a buffer to the DSP, then launches multiple threads that concurrently invoke the munmap ioctl on the same buffer handle. By winning the race condition - having both threads find the buffer in the list before either removes it - the attacker causes a use-after-free in kernel memory, which can be leveraged via heap-spray or similar techniques to overwrite kernel structures and escalate to root. … |
| Remediation | Upgrade the Linux kernel to a patched stable release: 6.6.152, 6.12.104, 6.18.45, 7.1.9, or 7.2 (or any later release in those series). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Linux systems with Qualcomm DSP processors and document kernel versions and local user access levels. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today