CVE-2026-53160

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free race condition exists in the fastrpc map create function. The fastrpc map lookup() function returns a raw pointer after releasing the fl->lock. Subsequently, fastrpc map create calls fastrpc map get() (which utilizes kref get unless zero) on this unprotected pointer. If a concurrent MEM UNMAP operation occurs, the map can be freed between the lock release and the kref operation, leading to a use-after-free on the freed slab object. A slab object is a chunk of memory allocated from a cache for a specific type of object.

Recommendations Restore the take ref parameter to the fastrpc map lookup() function to ensure the reference is acquired atomically under fl->lock before the pointer is exposed to the caller.