CVE-2026-53159
Received Received - Intake
DMA Address Corruption in Linux Kernel via find_vma Misuse

Publication date: 2026-06-25

Last updated on: 2026-06-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: fix DMA address corruption due to find_vma misuse fastrpc_get_args() uses find_vma() to look up the VMA for a user-provided pointer and compute a DMA address offset. When the address falls in a gap before the returned VMA, (ptr & PAGE_MASK) - vma->vm_start underflows, corrupting the DMA address sent to the DSP. Replace find_vma() with vma_lookup(), which returns NULL when the address is not contained within any VMA.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-25
Last Modified
2026-06-25
Generated
2026-06-25
AI Q&A
2026-06-25
EPSS Evaluated
N/A
NVD
CVE-2026-53159
EUVD
EUVD-2026-39250
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Mitigation Strategies

The vulnerability in the Linux kernel related to fastrpc's misuse of find_vma() has been fixed by replacing find_vma() with vma_lookup(), which prevents DMA address corruption.

To mitigate this vulnerability immediately, you should update your Linux kernel to a version that includes this fix.

Executive Summary

This vulnerability exists in the Linux kernel's fastrpc component, specifically in the function fastrpc_get_args(). The function uses find_vma() to locate the virtual memory area (VMA) for a user-provided pointer and calculate a DMA address offset. However, if the pointer falls into a gap before the returned VMA, an underflow occurs when computing the offset, which corrupts the DMA address sent to the DSP (Digital Signal Processor).

The issue arises because find_vma() returns the next VMA even if the address is not within any VMA, leading to incorrect calculations. The fix replaces find_vma() with vma_lookup(), which returns NULL if the address is not contained within any VMA, preventing the underflow and DMA address corruption.

Impact Analysis

This vulnerability can lead to corruption of the DMA address sent to the DSP. Such corruption may cause incorrect data transfers or processing by the DSP, potentially leading to system instability, crashes, or unintended behavior in applications relying on the fastrpc component.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53159. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart