CVE-2026-53161

In the Linux kernel, the following vulnerability has been resolved:

misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context

There is a race between fastrpcdevicerelease() and the workqueue that processes DSP responses. When the user closes the file descriptor, fastrpcdevicerelease() frees the fastrpcuser structure. Concurrently, an in-flight DSP invocation can complete and fastrpcrpmsgcallback() schedules context cleanup via schedulework(&ctx->putwork). If the workqueue runs fastrpccontextfree() in parallel with or after fastrpcdevicerelease() has freed the user structure, it dereferences the freed fastrpcuser. Depending on the state of the context at the time of the race, any one of the following accesses can be hit:

1. fastrpcbuffree() calls fastrpcipatodmaaddr(buf->fl->cctx, ...) to strip the SID bits from the stored IOVA before passing the physical address to dmafreecoherent().

2. fastrpcfreemap() reads map->fl->cctx->vmperms[0].vmid to reconstruct the source permission bitmask needed for the qcomscmassign_mem() call that returns memory from the DSP VM back to HLOS.

3. fastrpcfreemap() acquires map->fl->lock to safely remove the map node from the fl->maps list.

The resulting use-after-free manifests as:

pc : fastrpcbuffree+0x38/0x80 [fastrpc] lr : fastrpccontextfree+0xa8/0x1b0 [fastrpc] fastrpccontextfree+0xa8/0x1b0 [fastrpc] fastrpccontextputwq+0x78/0xa0 [fastrpc] processonework+0x180/0x450 workerthread+0x26c/0x388

Add kref-based reference counting to fastrpcuser. Have each invoke context take a reference on the user at allocation time and release it when the context is freed. Release the initial reference in fastrpcdevicerelease() at file close. Move the teardown of the user structure — freeing pending contexts, maps, mmaps, and the channel context reference — into the kref release callback fastrpcuser_free(), so that it runs only when the last reference is dropped, regardless of whether that happens at device close or after the final in-flight context completes.