SECUFOCUSNOW
Home›CVE index›CVE-2026-53160
Review reviewHigh

CVE-2026-53160

Linux Linux, linux kernel

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: fix use-after-free race in fastrpc_map_create fastrpc_map_lookup returns a raw pointer after releasing fl->lock. The caller fastrpc_map_create then calls fastrpc_map_get (kref_get_unless_zero) on this unprotected pointer. A concurrent MEM_UNMAP can free the map between the lock release and the kref operation, resulting in a use-after-free on the freed slab object. Restore the take_ref parameter to fastrpc_map_lookup so the reference is acquired atomically under fl->lock before the pointer is exposed to the ca...

CVSS
7.8
EPSS
0.13%
2.64% percentile
CISA KEV
Not listed
Published
2026.06.25
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.13%
Technical severityCVSS 7.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: fix use-after-free race in fastrpc_map_create fastrpc_map_lookup returns a raw pointer after releasing fl->lock. The caller fastrpc_map_create then calls fastrpc_map_get (kref_get_unless_zero) on this unprotected pointer. A concurrent MEM_UNMAP can free the map between the lock release and the kref operation, resulting in a use-after-free on the freed slab object. Restore the take_ref parameter to fastrpc_map_lookup so the reference is acquired atomically under fl->lock before the pointer is exposed to the ca...

Affected product and versions

Product
Linux Linux, linux kernel
Affected versions
0b70ec82b309a4093106ff399da1911ad23b52d3, d7513b47082c08105e837b06cebeb3f07a5fa56f, 802359a52676176b18713e33caa17572ad009057, 10df039834f84a297c72ec962c0f9b7c8c5ca31a, f3f59bab68e9bc714f757ab22f3fb36153014043, 6.1.156, 6.6.112, 6.12.53, 6.17.3, 6.18, >= 6.1.156 < 6.1.176, >= 6.6.112 < 6.6.143, >= 6.12.53 < 6.12.94, >= 6.17.3 < 6.18.36, >= 6.19 < 7.0.13, 7.1
Fixed versions
6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux Linux, linux kernel and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-416