CVE-2026-53161
published 2026-06-25CVE-2026-53161: In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context There is a race…
PriorityP342high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.14%
3.3th percentile
In the Linux kernel, the following vulnerability has been resolved:
misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context
There is a race between fastrpc_device_release() and the workqueue
that processes DSP responses. When the user closes the file descriptor,
fastrpc_device_release() frees the fastrpc_user structure. Concurrently,
an in-flight DSP invocation can complete and fastrpc_rpmsg_callback()
schedules context cleanup via schedule_work(&ctx->put_work). If the
workqueue runs fastrpc_context_free() in parallel with or after
fastrpc_device_release() has freed the user structure, it dereferences
the freed fastrpc_user. Depending on the state of the context at the
time of the race, any one of the following accesses can be hit:
1. fastrpc_buf_free() calls fastrpc_ipa_to_dma_addr(buf->fl->cctx, ...)
to strip the SID bits from the stored IOVA before passing the
physical address to dma_free_coherent().
2. fastrpc_free_map() reads map->fl->cctx->vmperms[0].vmid to
reconstruct the source permission bitmask needed for the
qcom_scm_assign_mem() call that returns memory from the DSP VM
back to HLOS.
3. fastrpc_free_map() acquires map->fl->lock to safely remove the
map node from the fl->maps list.
The resulting use-after-free manifests as:
pc : fastrpc_buf_free+0x38/0x80 [fastrpc]
lr : fastrpc_context_free+0xa8/0x1b0 [fastrpc]
fastrpc_context_free+0xa8/0x1b0 [fastrpc]
fastrpc_context_put_wq+0x78/0xa0 [fastrpc]
process_one_work+0x180/0x450
worker_thread+0x26c/0x388
Add kref-based reference counting to fastrpc_user. Have each invoke
context take a reference on the user at allocation time and release it
when the context is freed. Release the initial reference in
fastrpc_device_release() at file close. Move the teardown of the user
structure — freeing pending contexts, maps, mmaps, and the channel
context reference — into the kref release callback fastrpc_user_free(),
so that it runs only when the last reference is dropped, regardless of
whether that h
Affected
23 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= 6cffd79504ce040f460831030d3069fa1c99bb71 < c6e5c2be09f814377d7f1ce97370a5b7b3e02814 | c6e5c2be09f814377d7f1ce97370a5b7b3e02814 |
| linux | linux | >= 6cffd79504ce040f460831030d3069fa1c99bb71 < e1e3a05efe5954d5bad01157d79429d39a67a7ae | e1e3a05efe5954d5bad01157d79429d39a67a7ae |
| linux | linux | >= 6cffd79504ce040f460831030d3069fa1c99bb71 < d42679eef34dd590b694ce3b666c5e2ba10cd4bf | d42679eef34dd590b694ce3b666c5e2ba10cd4bf |
| linux | linux | >= 6cffd79504ce040f460831030d3069fa1c99bb71 < df08fadcf0e5f3708365ec3b6d30b5aafd98bea1 | df08fadcf0e5f3708365ec3b6d30b5aafd98bea1 |
| linux | linux | >= 6cffd79504ce040f460831030d3069fa1c99bb71 < ecea4967c2bff92c2fafbc59893f711b39f7b152 | ecea4967c2bff92c2fafbc59893f711b39f7b152 |
| linux | linux | >= 6cffd79504ce040f460831030d3069fa1c99bb71 < 5278ccd357e0d7aeeb1e76c0f3e0e02894a9897c | 5278ccd357e0d7aeeb1e76c0f3e0e02894a9897c |
| linux | linux | >= 6cffd79504ce040f460831030d3069fa1c99bb71 < fbe0947420eec18a84638d29468c2d563ce4e6a3 | fbe0947420eec18a84638d29468c2d563ce4e6a3 |
| linux | linux | >= 6cffd79504ce040f460831030d3069fa1c99bb71 < e85eb5feca8e254905ffa6c57a3c99c89a674a0f | e85eb5feca8e254905ffa6c57a3c99c89a674a0f |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 5.1 < 5.10.259 | 5.10.259 |
| linux | linux_kernel | >= 5.11 < 5.15.210 | 5.15.210 |
| linux | linux_kernel | >= 5.16 < 6.1.176 | 6.1.176 |
| linux | linux_kernel | >= 6.13 < 6.18.36 | 6.18.36 |
| linux | linux_kernel | >= 6.19 < 7.0.13 | 7.0.13 |
| linux | linux_kernel | >= 6.2 < 6.6.143 | 6.6.143 |
| linux | linux_kernel | >= 6.7 < 6.12.94 | 6.12.94 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context
vendor_redhat·2026-06-25
CVE-2026-53161 CWE-366 kernel: misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context
kernel: misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context
A flaw was found in the Linux kernel's fastrpc module. A race condition between closing a file descriptor and processing Digital Signal Processor (DSP) responses can lead to a use-after-free vulnerability. This allows a local attacker to potentially cause a system crash or, in some cases, execute arbitrary code or escalate privileges.
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 8) - Not affected
Package:
VulDB
Linux Kernel up to 7.0.12 misc fastrpc_device_release put_work use after free (WID-SEC-2026-2077)
vuldb·2026-06-29·CVSS 7.8
CVE-2026-53161 [HIGH] Linux Kernel up to 7.0.12 misc fastrpc_device_release put_work use after free (WID-SEC-2026-2077)
A vulnerability was found in Linux Kernel up to 7.0.12. It has been classified as critical. Affected by this vulnerability is the function fastrpc_device_release of the component Misc. Performing a manipulation of the argument put_work results in use after free.
This vulnerability is identified as CVE-2026-53161. The attack may be carried out on the physical device. There is not any exploit available.
Upgrading the affected component is recommended.
GHSA
In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context There is a race between fastrpc_device_release() and the wo
ghsa_unreviewed·2026-06-25
CVE-2026-53161 In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context There is a race between fastrpc_device_release() and the wo
In the Linux kernel, the following vulnerability has been resolved:
misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context
There is a race between fastrpc_device_release() and the workqueue
that processes DSP responses. When the user closes the file descriptor,
fastrpc_device_release() frees the fastrpc_user structure. Concurrently,
an in-flight DSP invocation can complete and fastrpc_rpmsg_callback()
schedules context cleanup via schedule_work(&ctx->put_work). If the
workqueue runs fastrpc_context_free() in parallel with or after
fastrpc_device_release() has freed the user structure, it dereferences
the freed fastrpc_user. Depending on the state of the context at the
time of the race, any one of the following accesses can be hit:
1. fastrpc_buf_free() calls fastrpc_ipa_
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-53161 kernel: misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context
bugzilla·2026-06-25
CVE-2026-53161 CVE-2026-53161 kernel: misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context
CVE-2026-53161 kernel: misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context
In the Linux kernel, the following vulnerability has been resolved:
misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context
There is a race between fastrpc_device_release() and the workqueue
that processes DSP responses. When the user closes the file descriptor,
fastrpc_device_release() frees the fastrpc_user structure. Concurrently,
an in-flight DSP invocation can complete and fastrpc_rpmsg_callback()
schedules context cleanup via schedule_work(&ctx->put_work). If the
workqueue runs fastrpc_context_free() in parallel with or after
fastrpc_device_release() has freed the user structure, it dereferences
the freed fastrpc_user. Depending on the state of the context at the
time of th
Bugzilla
CVE-2023-53161 kata-containers: Buffered-Reader Out-of-Bounds Access Vulnerability [fedora-42]
bugzilla·2025-07-28·CVSS 5.3
CVE-2023-53161 [MEDIUM] CVE-2023-53161 kata-containers: Buffered-Reader Out-of-Bounds Access Vulnerability [fedora-42]
CVE-2023-53161 kata-containers: Buffered-Reader Out-of-Bounds Access Vulnerability [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy to close a
https://git.kernel.org/stable/c/5278ccd357e0d7aeeb1e76c0f3e0e02894a9897chttps://git.kernel.org/stable/c/c6e5c2be09f814377d7f1ce97370a5b7b3e02814https://git.kernel.org/stable/c/d42679eef34dd590b694ce3b666c5e2ba10cd4bfhttps://git.kernel.org/stable/c/df08fadcf0e5f3708365ec3b6d30b5aafd98bea1https://git.kernel.org/stable/c/e1e3a05efe5954d5bad01157d79429d39a67a7aehttps://git.kernel.org/stable/c/e85eb5feca8e254905ffa6c57a3c99c89a674a0fhttps://git.kernel.org/stable/c/ecea4967c2bff92c2fafbc59893f711b39f7b152https://git.kernel.org/stable/c/fbe0947420eec18a84638d29468c2d563ce4e6a3
2026-06-25
Published