CVE-2026-53159

Analyzed Analyzed - Analysis Complete

DMA Address Corruption in Linux Kernel via find_vma Misuse

Publication date: 2026-06-25

Last updated on: 2026-07-07

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: fix DMA address corruption due to find_vma misuse fastrpc_get_args() uses find_vma() to look up the VMA for a user-provided pointer and compute a DMA address offset. When the address falls in a gap before the returned VMA, (ptr & PAGE_MASK) - vma->vm_start underflows, corrupting the DMA address sent to the DSP. Replace find_vma() with vma_lookup(), which returns NULL when the address is not contained within any VMA.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-25

Last Modified

2026-07-07

Generated

2026-07-15

AI Q&A

2026-06-25

EPSS Evaluated

2026-07-14

NVD

CVE-2026-53159

EUVD

EUVD-2026-39250

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 5.16 (inc) to 6.1.176 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.143 (exc)
linux	linux_kernel	From 5.11 (inc) to 5.15.210 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.36 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.94 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.13 (exc)
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 5.1.6 (inc) to 5.10.260 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Mitigation Strategies

The vulnerability in the Linux kernel related to fastrpc's misuse of find_vma() has been fixed by replacing find_vma() with vma_lookup(), which prevents DMA address corruption.

To mitigate this vulnerability immediately, you should update your Linux kernel to a version that includes this fix.

Executive Summary

This vulnerability exists in the Linux kernel's fastrpc component, specifically in the function fastrpc_get_args(). The function uses find_vma() to locate the virtual memory area (VMA) for a user-provided pointer and calculate a DMA address offset. However, if the pointer falls into a gap before the returned VMA, an underflow occurs when computing the offset, which corrupts the DMA address sent to the DSP (Digital Signal Processor).

The issue arises because find_vma() returns the next VMA even if the address is not within any VMA, leading to incorrect calculations. The fix replaces find_vma() with vma_lookup(), which returns NULL if the address is not contained within any VMA, preventing the underflow and DMA address corruption.

Impact Analysis

This vulnerability can lead to corruption of the DMA address sent to the DSP. Such corruption may cause incorrect data transfers or processing by the DSP, potentially leading to system instability, crashes, or unintended behavior in applications relying on the fastrpc component.

Hi! I’m here to help you understand CVE-2026-53159. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70