High 7.8Published Jun 25, 2026

CVE-2026-53160misc: fastrpc: fix use-after-free race in fastrpc_map_create

Updated under an hour ago (Oct 27, 2026, 6:50 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: fix use-after-free race in fastrpc_map_create fastrpc_map_lookup returns a raw pointer after releasing fl->lock. The caller fastrpc_map_create then calls fastrpc_map_get (kref_get_unless_zero) on this unprotected pointer. A concurrent MEM_UNMAP can free the map between the lock release and the kref operation, resulting in a use-after-free on the freed slab object. Restore the take_ref parameter to fastrpc_map_lookup so the reference is acquired atomically under fl->lock before the pointer is exposed to the caller.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Aug 5, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	0b70ec82b309a4093106ff399da1911ad23b52d3 builds before 0a3b87293fbd34fda651e6aead9964f84b893962; from d7513b47082c08105e837b06cebeb3f07a5fa56f before 8b080c89183196fd3e49212f2a1a1c4a29335b9c; 802359a52676176b18713e33caa17572ad009057 builds before 5b0166112019d1dce30b976ab28fd67f7f0be532; from 10df039834f84a297c72ec962c0f9b7c8c5ca31a before 992f121796b7ca83a5a8b93da24e971363206218; from 10df039834f84a297c72ec962c0f9b7c8c5ca31a before f20f6512ecb75c816e0debf4551a138f098615c4; 10df039834f84a297c72ec962c0f9b7c8c5ca31a builds before 07ebe87915d8accdaba20c4f88c5ae430fe62fbb; f3f59bab68e9bc714f757ab22f3fb36153014043; from 6.1.156 before 6.1.176; and 3 more ranges	CNA record
linux linux_kernel linux:linux_kernel	from 6.1.156 before 6.1.176; from 6.6.112 before 6.6.143; from 6.12.53 before 6.12.94; from 6.17.3 before 6.18.36; from 6.19 before 7.0.13; 7.1; 7.1; 7.1; and 4 more ranges	NVD

References

References

https://git.kernel.org/stable/c/0a3b87293fbd34fda651e6aead9964f84b893962	patch
https://git.kernel.org/stable/c/8b080c89183196fd3e49212f2a1a1c4a29335b9c	patch
https://git.kernel.org/stable/c/5b0166112019d1dce30b976ab28fd67f7f0be532	patch
https://git.kernel.org/stable/c/992f121796b7ca83a5a8b93da24e971363206218	patch
https://git.kernel.org/stable/c/f20f6512ecb75c816e0debf4551a138f098615c4	patch
https://git.kernel.org/stable/c/07ebe87915d8accdaba20c4f88c5ae430fe62fbb	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.