CVE-2026-31730

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A double-free issue exists in the fastrpc component. The function fastrpc init create static process() may free the cctx->remote heap variable on the err map path without clearing the pointer. Subsequently, if the INIT CREATE STATIC ioctl hits the error path and the rpmsg device is removed or unbound, the fastrpc rpmsg remove() function frees cctx->remote heap again because the pointer is still non-NULL.

Recommendations Clear the cctx->remote heap pointer immediately after freeing it in the error path to prevent subsequent cleanup functions from attempting to free the same memory again.