CVE-2026-74647
Received Received - Intake

Race Condition in Linux Kernel FastRPC Module

Vulnerability report for CVE-2026-74647, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: Remove buffer from list prior to unmap operation fastrpc_req_munmap_impl() is called to unmap any buffer. The buffer is getting removed from the list after it is unmapped from DSP. This can create potential race conditions if multiple threads invoke unmap concurrently, where one thread may remove the entry from the list while another thread's unmap operation is still ongoing. Fix this by removing the buffer entry from the list before calling the unmap operation. If the unmap fails, the entry is re-added to the list so that userspace can retry the unmap, or alternatively, the buffer will be cleaned up during device release when the DSP process is torn down and all DSP-side mappings are freed along with remaining buffers in the list.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
EUVD

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a race condition in the fastrpc driver. The issue occurs in fastrpc_req_munmap_impl() where a buffer is unlinked from a list after being unmapped from the DSP (Digital Signal Processor). If multiple threads call unmap simultaneously, one thread might remove the buffer from the list while another thread is still unmaping it, causing potential instability or crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's fastrpc module and involves a race condition during buffer unmapping. Detection requires checking kernel logs for fastrpc-related errors or kernel crashes during unmap operations. Monitor for kernel oops messages or system hangs when DSP processes are active. No direct network detection commands apply as this is a local kernel issue.

Impact Analysis

This vulnerability could lead to system instability, crashes, or unexpected behavior if exploited. It may cause applications relying on fastrpc to malfunction, potentially disrupting services that depend on DSP operations like audio processing or real-time computations.

Mitigation Strategies

Apply the latest Linux kernel patches that include the fix for this fastrpc race condition. If immediate patching is not possible, consider disabling the fastrpc module if not required by your system. Monitor kernel logs for fastrpc-related errors and avoid running untrusted DSP applications until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74647. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart