CVE-2026-53158

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A NULL pointer dereference occurs in the fastrpc component during boot when the DSP sends a glink message before the fastrpc rpmsg probe() function completes initialization. This happens because the rpmsg channel becomes active as soon as the driver is bound, allowing the fastrpc rpmsg callback() function to execute before dev set drvdata() is called, or while the spinlock within struct fastrpc channel ctx is still uninitialized. Consequently, the system attempts to access a NULL pointer when the fastrpc rpmsg callback() function tries to acquire the spinlock.

Recommendations As a temporary mitigation, restrict the use of the fastrpc rpmsg callback() function or the fastrpc module until the system is fully initialized. At the moment, there is no information about a newer version that contains a fix for this vulnerability.