CVE-2026-53159

misc: fastrpc: fix DMA address corruption due to find_vma misuse

State: Published
Severity: 8.8 High
Published: Jun 25, 2026
Updated: Aug 5, 2026
Reserved: Jun 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

misc: fastrpc: fix DMA address corruption due to find_vma misuse

fastrpc_get_args() uses find_vma() to look up the VMA for a user-provided pointer and compute a DMA address offset. When the address falls in a gap before the returned VMA, (ptr & PAGE_MASK) - vma->vm_start underflows, corrupting the DMA address sent to the DSP.

Replace find_vma() with vma_lookup(), which returns NULL when the address is not contained within any VMA.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	80f3afd72bd4149c57daf852905476b43bb47647 to before d43afc412d439ffca1567e7ca8652be22f272b3bAffected 80f3afd72bd4149c57daf852905476b43bb47647 to before 2d0f47e27c1fa718b29c69aa7c96a2c5161bc2c2Affected 80f3afd72bd4149c57daf852905476b43bb47647 to before 708c17b52c60fe7a57e73b495bdee50f58feb48cAffected 80f3afd72bd4149c57daf852905476b43bb47647 to before d3e26df2e8eb361e6bef096b2fd565476a1f14c4Affected 80f3afd72bd4149c57daf852905476b43bb47647 to before e69e306a4cccb40a73511350cb280825a556ce3cAffected 80f3afd72bd4149c57daf852905476b43bb47647 to before 53e06f8a3c2b085c31bf1284e2ebcb8036e99625Affected 80f3afd72bd4149c57daf852905476b43bb47647 to before 7ba7b30ddb04646d4d638f4d8c4718a304bbbdddAffected 80f3afd72bd4149c57daf852905476b43bb47647 to before 464c6ad2aa16e1e1df9d559289199356493d1e00Affected 954edc466128479872731d06f026d0e71840d153Affected 5.1.6 to before 5.2Affected
LinuxLinux	5.2Affected before 5.2Not affected 5.10.260 through 5.10.Not affected 5.15.210 through 5.15.Not affected 6.1.176 through 6.1.Not affected 6.6.143 through 6.6.Not affected 6.12.94 through 6.12.Not affected 6.18.36 through 6.18.Not affected 7.0.13 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

80f3afd72bd4149c57daf852905476b43bb47647 to before d43afc412d439ffca1567e7ca8652be22f272b3bAffected
80f3afd72bd4149c57daf852905476b43bb47647 to before 2d0f47e27c1fa718b29c69aa7c96a2c5161bc2c2Affected
80f3afd72bd4149c57daf852905476b43bb47647 to before 708c17b52c60fe7a57e73b495bdee50f58feb48cAffected
80f3afd72bd4149c57daf852905476b43bb47647 to before d3e26df2e8eb361e6bef096b2fd565476a1f14c4Affected
80f3afd72bd4149c57daf852905476b43bb47647 to before e69e306a4cccb40a73511350cb280825a556ce3cAffected
80f3afd72bd4149c57daf852905476b43bb47647 to before 53e06f8a3c2b085c31bf1284e2ebcb8036e99625Affected
80f3afd72bd4149c57daf852905476b43bb47647 to before 7ba7b30ddb04646d4d638f4d8c4718a304bbbdddAffected
80f3afd72bd4149c57daf852905476b43bb47647 to before 464c6ad2aa16e1e1df9d559289199356493d1e00Affected
954edc466128479872731d06f026d0e71840d153Affected
5.1.6 to before 5.2Affected

LinuxLinux

5.2Affected
before 5.2Not affected
5.10.260 through 5.10.*Not affected
5.15.210 through 5.15.*Not affected
6.1.176 through 6.1.*Not affected
6.6.143 through 6.6.*Not affected
6.12.94 through 6.12.*Not affected
6.18.36 through 6.18.*Not affected
7.0.13 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.