{"api_version":"1","generated_at":"2026-08-22T21:53:00+00:00","cve":"CVE-2026-74647","urls":{"html":"https://cve.report/CVE-2026-74647","api":"https://cve.report/api/cve/CVE-2026-74647.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-74647","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-74647"},"summary":{"title":"misc: fastrpc: Remove buffer from list prior to unmap operation","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: fastrpc: Remove buffer from list prior to unmap operation\n\nfastrpc_req_munmap_impl() is called to unmap any buffer. The buffer is\ngetting removed from the list after it is unmapped from DSP. This can\ncreate potential race conditions if multiple threads invoke unmap\nconcurrently, where one thread may remove the entry from the list while\nanother thread's unmap operation is still ongoing.\n\nFix this by removing the buffer entry from the list before calling the\nunmap operation. If the unmap fails, the entry is re-added to the list\nso that userspace can retry the unmap, or alternatively, the buffer\nwill be cleaned up during device release when the DSP process is torn\ndown and all DSP-side mappings are freed along with remaining buffers\nin the list.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-08-22 16:16:38","updated_at":"2026-08-22 16:16:38"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/97273624f7b356eaf8261609a75cfcb8738a165a","name":"https://git.kernel.org/stable/c/97273624f7b356eaf8261609a75cfcb8738a165a","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/fe70329055977fc1e8dc6291318d0dd75470795a","name":"https://git.kernel.org/stable/c/fe70329055977fc1e8dc6291318d0dd75470795a","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/0beaa9bd7eb10d9b5e6352ed5161f3f3bbd4c3c5","name":"https://git.kernel.org/stable/c/0beaa9bd7eb10d9b5e6352ed5161f3f3bbd4c3c5","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/6102ceb4eab845743ee57acd3863fbd06e93c927","name":"https://git.kernel.org/stable/c/6102ceb4eab845743ee57acd3863fbd06e93c927","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/9bf22a7d950cec2d1efeca7f16bb20fcca84c36a","name":"https://git.kernel.org/stable/c/9bf22a7d950cec2d1efeca7f16bb20fcca84c36a","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-74647","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74647","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 2419e55e532de14fdf336e09e453aa2831c73a25 97273624f7b356eaf8261609a75cfcb8738a165a git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 2419e55e532de14fdf336e09e453aa2831c73a25 fe70329055977fc1e8dc6291318d0dd75470795a git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 2419e55e532de14fdf336e09e453aa2831c73a25 9bf22a7d950cec2d1efeca7f16bb20fcca84c36a git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 2419e55e532de14fdf336e09e453aa2831c73a25 0beaa9bd7eb10d9b5e6352ed5161f3f3bbd4c3c5 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 2419e55e532de14fdf336e09e453aa2831c73a25 6102ceb4eab845743ee57acd3863fbd06e93c927 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.5","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.5 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.152 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.104 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.45 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1.9 7.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/misc/fastrpc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"97273624f7b356eaf8261609a75cfcb8738a165a","status":"affected","version":"2419e55e532de14fdf336e09e453aa2831c73a25","versionType":"git"},{"lessThan":"fe70329055977fc1e8dc6291318d0dd75470795a","status":"affected","version":"2419e55e532de14fdf336e09e453aa2831c73a25","versionType":"git"},{"lessThan":"9bf22a7d950cec2d1efeca7f16bb20fcca84c36a","status":"affected","version":"2419e55e532de14fdf336e09e453aa2831c73a25","versionType":"git"},{"lessThan":"0beaa9bd7eb10d9b5e6352ed5161f3f3bbd4c3c5","status":"affected","version":"2419e55e532de14fdf336e09e453aa2831c73a25","versionType":"git"},{"lessThan":"6102ceb4eab845743ee57acd3863fbd06e93c927","status":"affected","version":"2419e55e532de14fdf336e09e453aa2831c73a25","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/misc/fastrpc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.5"},{"lessThan":"5.5","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.152","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.104","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.45","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.9","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.152","versionStartIncluding":"5.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.104","versionStartIncluding":"5.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.45","versionStartIncluding":"5.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.9","versionStartIncluding":"5.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2","versionStartIncluding":"5.5","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: fastrpc: Remove buffer from list prior to unmap operation\n\nfastrpc_req_munmap_impl() is called to unmap any buffer. The buffer is\ngetting removed from the list after it is unmapped from DSP. This can\ncreate potential race conditions if multiple threads invoke unmap\nconcurrently, where one thread may remove the entry from the list while\nanother thread's unmap operation is still ongoing.\n\nFix this by removing the buffer entry from the list before calling the\nunmap operation. If the unmap fails, the entry is re-added to the list\nso that userspace can retry the unmap, or alternatively, the buffer\nwill be cleaned up during device release when the DSP process is torn\ndown and all DSP-side mappings are freed along with remaining buffers\nin the list."}],"providerMetadata":{"dateUpdated":"2026-08-22T15:32:24.127Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/97273624f7b356eaf8261609a75cfcb8738a165a"},{"url":"https://git.kernel.org/stable/c/fe70329055977fc1e8dc6291318d0dd75470795a"},{"url":"https://git.kernel.org/stable/c/9bf22a7d950cec2d1efeca7f16bb20fcca84c36a"},{"url":"https://git.kernel.org/stable/c/0beaa9bd7eb10d9b5e6352ed5161f3f3bbd4c3c5"},{"url":"https://git.kernel.org/stable/c/6102ceb4eab845743ee57acd3863fbd06e93c927"}],"title":"misc: fastrpc: Remove buffer from list prior to unmap operation","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-74647","datePublished":"2026-08-22T15:32:24.127Z","dateReserved":"2026-08-15T05:44:03.923Z","dateUpdated":"2026-08-22T15:32:24.127Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-22 16:16:38","lastModifiedDate":"2026-08-22 16:16:38","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"74647","Ordinal":"1","Title":"misc: fastrpc: Remove buffer from list prior to unmap operation","CVE":"CVE-2026-74647","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"74647","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: fastrpc: Remove buffer from list prior to unmap operation\n\nfastrpc_req_munmap_impl() is called to unmap any buffer. The buffer is\ngetting removed from the list after it is unmapped from DSP. This can\ncreate potential race conditions if multiple threads invoke unmap\nconcurrently, where one thread may remove the entry from the list while\nanother thread's unmap operation is still ongoing.\n\nFix this by removing the buffer entry from the list before calling the\nunmap operation. If the unmap fails, the entry is re-added to the list\nso that userspace can retry the unmap, or alternatively, the buffer\nwill be cleaned up during device release when the DSP process is torn\ndown and all DSP-side mappings are freed along with remaining buffers\nin the list.","Type":"Description","Title":"misc: fastrpc: Remove buffer from list prior to unmap operation"}]}}}