GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-74646 (GCVE-0-2026-74646)

Vulnerability from cvelistv5 – Published: 2026-08-22 15:32 – Updated: 2026-08-25 05:41
VLAI
Title
misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke
Summary
In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke When an invoke is interrupted by a signal, wait_for_completion_interruptible() returns -ERESTARTSYS and fastrpc_internal_invoke() moves every buffer from fl->mmaps onto cctx->invoke_interrupted_mmaps. This list_del()/list_add_tail() walk runs without holding fl->lock, the lock that serialises fl->mmaps in fastrpc_req_mmap() and fastrpc_req_munmap() everywhere else. Take fl->lock around the move, matching every other fl->mmaps accessor.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 76e8e4ace1ed2c97dba3b1370e0e105e07c572bc , < 3f265e405e5ef85030c3777262e18bb556bc8724 (git)
Affected: 76e8e4ace1ed2c97dba3b1370e0e105e07c572bc , < a902fe1f80f58a2335b6be1131866f827ec44d1a (git)
Affected: 76e8e4ace1ed2c97dba3b1370e0e105e07c572bc , < af6345159abcbaa550518f31990d2a9558c2d369 (git)
Affected: 76e8e4ace1ed2c97dba3b1370e0e105e07c572bc , < efd02f8d1a7449f15809bc18d3cd41aafea75d7e (git)
Affected: 76e8e4ace1ed2c97dba3b1370e0e105e07c572bc , < b85a0e91d7d6cd06a53c881a46f749cfcef416a2 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.2
Unaffected: 0 , < 6.2 (semver)
Unaffected: 6.6.152 , ≤ 6.6.* (semver)
Unaffected: 6.12.104 , ≤ 6.12.* (semver)
Unaffected: 6.18.45 , ≤ 6.18.* (semver)
Unaffected: 7.1.9 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/misc/fastrpc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3f265e405e5ef85030c3777262e18bb556bc8724",
              "status": "affected",
              "version": "76e8e4ace1ed2c97dba3b1370e0e105e07c572bc",
              "versionType": "git"
            },
            {
              "lessThan": "a902fe1f80f58a2335b6be1131866f827ec44d1a",
              "status": "affected",
              "version": "76e8e4ace1ed2c97dba3b1370e0e105e07c572bc",
              "versionType": "git"
            },
            {
              "lessThan": "af6345159abcbaa550518f31990d2a9558c2d369",
              "status": "affected",
              "version": "76e8e4ace1ed2c97dba3b1370e0e105e07c572bc",
              "versionType": "git"
            },
            {
              "lessThan": "efd02f8d1a7449f15809bc18d3cd41aafea75d7e",
              "status": "affected",
              "version": "76e8e4ace1ed2c97dba3b1370e0e105e07c572bc",
              "versionType": "git"
            },
            {
              "lessThan": "b85a0e91d7d6cd06a53c881a46f749cfcef416a2",
              "status": "affected",
              "version": "76e8e4ace1ed2c97dba3b1370e0e105e07c572bc",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/misc/fastrpc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: fastrpc: take fl-\u003elock when moving mmaps on interrupted invoke\n\nWhen an invoke is interrupted by a signal,\nwait_for_completion_interruptible() returns -ERESTARTSYS and\nfastrpc_internal_invoke() moves every buffer from fl-\u003emmaps onto\ncctx-\u003einvoke_interrupted_mmaps. This list_del()/list_add_tail() walk\nruns without holding fl-\u003elock, the lock that serialises fl-\u003emmaps in\nfastrpc_req_mmap() and fastrpc_req_munmap() everywhere else.\n\nTake fl-\u003elock around the move, matching every other fl-\u003emmaps accessor."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Reachable only through local ioctl on the Qualcomm FastRPC miscdevice (/dev/fastrpc-*); communication with the DSP is internal rpmsg/glink IPC on the SoC, not via network or adjacent wireless protocols.\nAC:L - Attacker controls both sides: one thread blocks in FASTRPC_IOCTL_INVOKE, delivers a signal to force -ERESTARTSYS, and another thread issues concurrent FASTRPC_IOCTL_MMAP/MUNMAP on the same fd; the race can be retried until it wins.\nPR:L - fastrpc_device_ioctl has no capability check; on Qualcomm/Android deployments non-root processes with FastRPC device access (HALs, system services, or unsigned-PD offload clients) can open the node and hit the vulnerable path without real root.\nUI:N - No victim interaction is required beyond the attacker\u0027s own local access; exploitation uses attacker-controlled threads and signals to race ioctls on an already-open FastRPC file descriptor.\nS:U - The bug corrupts kernel linked-list/heap state in the host OS FastRPC driver; impact is local kernel privilege escalation within the same security authority, not a VM escape or IOMMU boundary bypass.\nC:H - Unsynchronized list_del/list_add_tail on fl-\u003emmaps corrupts kernel list pointers and can orphan or double-reference fastrpc_buf objects, enabling use-after-free and kernel memory disclosure primitives.\nI:H - Corrupting mmap tracking list nodes in kernel heap can yield double-free or use-after-free of fastrpc_buf slabs, which are standard primitives for arbitrary kernel write and control-flow hijacking.\nA:H - List corruption on fl-\u003emmaps reliably causes kernel oops/panic during subsequent mmap/munmap or user teardown; repeated ioctl racing can crash or hang the device."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:41:04.331Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3f265e405e5ef85030c3777262e18bb556bc8724"
        },
        {
          "url": "https://git.kernel.org/stable/c/a902fe1f80f58a2335b6be1131866f827ec44d1a"
        },
        {
          "url": "https://git.kernel.org/stable/c/af6345159abcbaa550518f31990d2a9558c2d369"
        },
        {
          "url": "https://git.kernel.org/stable/c/efd02f8d1a7449f15809bc18d3cd41aafea75d7e"
        },
        {
          "url": "https://git.kernel.org/stable/c/b85a0e91d7d6cd06a53c881a46f749cfcef416a2"
        }
      ],
      "title": "misc: fastrpc: take fl-\u003elock when moving mmaps on interrupted invoke",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74646",
    "datePublished": "2026-08-22T15:32:23.378Z",
    "dateReserved": "2026-08-15T05:44:03.923Z",
    "dateUpdated": "2026-08-25T05:41:04.331Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74646",
      "date": "2026-09-15",
      "epss": "0.00129",
      "percentile": "0.0284"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-24T14:46:50.000Z",
      "cve": "CVE-2026-74646",
      "id": "msrc_CVE-2026-74646",
      "initial_release_date": "2026-08-24T01:02:19.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "misc: fastrpc: take fl-\u003elock when moving mmaps on interrupted invoke",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74646.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74646\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-22T16:16:37.940\",\"lastModified\":\"2026-08-25T06:18:44.283\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmisc: fastrpc: take fl-\u003elock when moving mmaps on interrupted invoke\\n\\nWhen an invoke is interrupted by a signal,\\nwait_for_completion_interruptible() returns -ERESTARTSYS and\\nfastrpc_internal_invoke() moves every buffer from fl-\u003emmaps onto\\ncctx-\u003einvoke_interrupted_mmaps. This list_del()/list_add_tail() walk\\nruns without holding fl-\u003elock, the lock that serialises fl-\u003emmaps in\\nfastrpc_req_mmap() and fastrpc_req_munmap() everywhere else.\\n\\nTake fl-\u003elock around the move, matching every other fl-\u003emmaps accessor.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/misc/fastrpc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"76e8e4ace1ed2c97dba3b1370e0e105e07c572bc\",\"lessThan\":\"3f265e405e5ef85030c3777262e18bb556bc8724\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"76e8e4ace1ed2c97dba3b1370e0e105e07c572bc\",\"lessThan\":\"a902fe1f80f58a2335b6be1131866f827ec44d1a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"76e8e4ace1ed2c97dba3b1370e0e105e07c572bc\",\"lessThan\":\"af6345159abcbaa550518f31990d2a9558c2d369\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"76e8e4ace1ed2c97dba3b1370e0e105e07c572bc\",\"lessThan\":\"efd02f8d1a7449f15809bc18d3cd41aafea75d7e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"76e8e4ace1ed2c97dba3b1370e0e105e07c572bc\",\"lessThan\":\"b85a0e91d7d6cd06a53c881a46f749cfcef416a2\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/misc/fastrpc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.2\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.2\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.152\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.104\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.45\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.9\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3f265e405e5ef85030c3777262e18bb556bc8724\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a902fe1f80f58a2335b6be1131866f827ec44d1a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/af6345159abcbaa550518f31990d2a9558c2d369\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b85a0e91d7d6cd06a53c881a46f749cfcef416a2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/efd02f8d1a7449f15809bc18d3cd41aafea75d7e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-25T08:52:45+00:00",
      "cve": "CVE-2026-74646",
      "id": "CVE-2026-74646",
      "initial_release_date": "2026-08-22T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: misc: fastrpc: take fl-\u003elock when moving mmaps on interrupted invoke",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74646.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T01:08:11Z",
      "cve": "CVE-2026-74646",
      "id": "CVE-2026-74646",
      "initial_release_date": "2026-08-23T00:05:17Z",
      "product_status:known_affected": "30",
      "product_status:known_not_affected": "327",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74646",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74646.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.