CVE-2026-53158
misc: fastrpc: Fix NULL pointer dereference in rpmsg callback
Description
In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: Fix NULL pointer dereference in rpmsg callback A NULL pointer dereference was observed on Hawi at boot when the DSP sends a glink message before fastrpc_rpmsg_probe() has completed initialization: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000178 pc : _raw_spin_lock_irqsave+0x34/0x8c lr : fastrpc_rpmsg_callback+0x3c/0xcc [fastrpc] ... Call trace: _raw_spin_lock_irqsave+0x34/0x8c (P) fastrpc_rpmsg_callback+0x3c/0xcc [fastrpc] qcom_glink_native_rx+0x538/0x6a4 qcom_glink_smem_intr+0x14/0x24 [qcom_glink_smem] The faulting address 0x178 corresponds to the lock variable inside struct fastrpc_channel_ctx, confirming that cctx is NULL when fastrpc_rpmsg_callback() attempts to take the spinlock. There are two issues here. First, dev_set_drvdata() is called before spin_lock_init() and idr_init(), leaving a window where the callback can retrieve a valid cctx pointer but operate on an uninitialized spinlock. Second, the rpmsg channel becomes live as soon as the driver is bound, so fastrpc_rpmsg_callback() can fire before dev_set_drvdata() is called at all, resulting in dev_get_drvdata() returning NULL. Fix both issues by moving all cctx initialization ahead of dev_set_drvdata() so the structure is fully initialized before it becomes visible to the callback, and add a NULL check in fastrpc_rpmsg_callback() as a guard against any remaining window.
INFO
Published Date :
June 25, 2026, 9:16 a.m.
Last Modified :
July 7, 2026, 6:51 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | MEDIUM | [email protected] |
Solution
- Initialize context before setting driver data.
- Add NULL check in rpmsg callback function.
- Ensure full context initialization before visibility.
- Apply provided kernel patch.
Public PoC/Exploit Available at Github
CVE-2026-53158 has a 1 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-53158.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-53158 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-53158
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
DSA and DLA for Debian last 14 days
Python
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-53158 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-53158 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Jul. 07, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Added CWE CWE-476 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.143 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.18.36 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.94 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 7.0.13 *cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc7:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.177 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.211 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.1 up to (excluding) 5.10.260 Added Reference Type kernel.org: https://git.kernel.org/stable/c/0d8c64511fd45690c5326f013710efcb4f73a97e Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/150bf6f1193c69252580c19d3b3cd631ddce61d7 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/4bfdf0a9855df55e9e031ca6a25b855820590c70 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/5401fb4fe10fac6134c308495df18ed74aebb9c4 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/8fb4a23df5b7c02929b62e5dbc270ec7c42b8134 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/a3d91218ccca1e990bfb737b5a6da23f0afba22b Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/d5de9cb5355db36438edc621dde3673e3f235767 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/d77583ca33299fede0c194744ef2284e7ba5b763 Types: Patch -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jul. 04, 2026
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/0d8c64511fd45690c5326f013710efcb4f73a97e Added Reference https://git.kernel.org/stable/c/150bf6f1193c69252580c19d3b3cd631ddce61d7 Added Reference https://git.kernel.org/stable/c/a3d91218ccca1e990bfb737b5a6da23f0afba22b Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'f6f9279f2bf0e37e2f1fb119d8832b8568536a04', 'lessThan': '8fb4a23df5b7c02929b62e5dbc270ec7c42b8134', 'versionType': 'git'}, {'status': 'affected', 'version': 'f6f9279f2bf0e37e2f1fb119d8832b8568536a04', 'lessThan': '4bfdf0a9855df55e9e031ca6a25b855820590c70', 'versionType': 'git'}, {'status': 'affected', 'version': 'f6f9279f2bf0e37e2f1fb119d8832b8568536a04', 'lessThan': 'd5de9cb5355db36438edc621dde3673e3f235767', 'versionType': 'git'}, {'status': 'affected', 'version': 'f6f9279f2bf0e37e2f1fb119d8832b8568536a04', 'lessThan': 'd77583ca33299fede0c194744ef2284e7ba5b763', 'versionType': 'git'}, {'status': 'affected', 'version': 'f6f9279f2bf0e37e2f1fb119d8832b8568536a04', 'lessThan': '5401fb4fe10fac6134c308495df18ed74aebb9c4', 'versionType': 'git'}], 'programFiles': ['drivers/misc/fastrpc.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.1'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.1', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.143', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.94', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.36', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.13', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/misc/fastrpc.c'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'f6f9279f2bf0e37e2f1fb119d8832b8568536a04', 'lessThan': 'a3d91218ccca1e990bfb737b5a6da23f0afba22b', 'versionType': 'git'}, {'status': 'affected', 'version': 'f6f9279f2bf0e37e2f1fb119d8832b8568536a04', 'lessThan': '0d8c64511fd45690c5326f013710efcb4f73a97e', 'versionType': 'git'}, {'status': 'affected', 'version': 'f6f9279f2bf0e37e2f1fb119d8832b8568536a04', 'lessThan': '150bf6f1193c69252580c19d3b3cd631ddce61d7', 'versionType': 'git'}, {'status': 'affected', 'version': 'f6f9279f2bf0e37e2f1fb119d8832b8568536a04', 'lessThan': '8fb4a23df5b7c02929b62e5dbc270ec7c42b8134', 'versionType': 'git'}, {'status': 'affected', 'version': 'f6f9279f2bf0e37e2f1fb119d8832b8568536a04', 'lessThan': '4bfdf0a9855df55e9e031ca6a25b855820590c70', 'versionType': 'git'}, {'status': 'affected', 'version': 'f6f9279f2bf0e37e2f1fb119d8832b8568536a04', 'lessThan': 'd5de9cb5355db36438edc621dde3673e3f235767', 'versionType': 'git'}, {'status': 'affected', 'version': 'f6f9279f2bf0e37e2f1fb119d8832b8568536a04', 'lessThan': 'd77583ca33299fede0c194744ef2284e7ba5b763', 'versionType': 'git'}, {'status': 'affected', 'version': 'f6f9279f2bf0e37e2f1fb119d8832b8568536a04', 'lessThan': '5401fb4fe10fac6134c308495df18ed74aebb9c4', 'versionType': 'git'}], 'programFiles': ['drivers/misc/fastrpc.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.1'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.1', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.260', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.211', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.177', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.143', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.94', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.36', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.13', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/misc/fastrpc.c'], 'defaultStatus': 'affected'}] -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 25, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'f6f9279f2bf0e37e2f1fb119d8832b8568536a04', 'lessThan': '8fb4a23df5b7c02929b62e5dbc270ec7c42b8134', 'versionType': 'git'}, {'status': 'affected', 'version': 'f6f9279f2bf0e37e2f1fb119d8832b8568536a04', 'lessThan': '4bfdf0a9855df55e9e031ca6a25b855820590c70', 'versionType': 'git'}, {'status': 'affected', 'version': 'f6f9279f2bf0e37e2f1fb119d8832b8568536a04', 'lessThan': 'd5de9cb5355db36438edc621dde3673e3f235767', 'versionType': 'git'}, {'status': 'affected', 'version': 'f6f9279f2bf0e37e2f1fb119d8832b8568536a04', 'lessThan': 'd77583ca33299fede0c194744ef2284e7ba5b763', 'versionType': 'git'}, {'status': 'affected', 'version': 'f6f9279f2bf0e37e2f1fb119d8832b8568536a04', 'lessThan': '5401fb4fe10fac6134c308495df18ed74aebb9c4', 'versionType': 'git'}], 'programFiles': ['drivers/misc/fastrpc.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.1'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.1', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.143', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.94', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.36', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.13', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/misc/fastrpc.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: Fix NULL pointer dereference in rpmsg callback A NULL pointer dereference was observed on Hawi at boot when the DSP sends a glink message before fastrpc_rpmsg_probe() has completed initialization: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000178 pc : _raw_spin_lock_irqsave+0x34/0x8c lr : fastrpc_rpmsg_callback+0x3c/0xcc [fastrpc] ... Call trace: _raw_spin_lock_irqsave+0x34/0x8c (P) fastrpc_rpmsg_callback+0x3c/0xcc [fastrpc] qcom_glink_native_rx+0x538/0x6a4 qcom_glink_smem_intr+0x14/0x24 [qcom_glink_smem] The faulting address 0x178 corresponds to the lock variable inside struct fastrpc_channel_ctx, confirming that cctx is NULL when fastrpc_rpmsg_callback() attempts to take the spinlock. There are two issues here. First, dev_set_drvdata() is called before spin_lock_init() and idr_init(), leaving a window where the callback can retrieve a valid cctx pointer but operate on an uninitialized spinlock. Second, the rpmsg channel becomes live as soon as the driver is bound, so fastrpc_rpmsg_callback() can fire before dev_set_drvdata() is called at all, resulting in dev_get_drvdata() returning NULL. Fix both issues by moving all cctx initialization ahead of dev_set_drvdata() so the structure is fully initialized before it becomes visible to the callback, and add a NULL check in fastrpc_rpmsg_callback() as a guard against any remaining window. Added Reference https://git.kernel.org/stable/c/4bfdf0a9855df55e9e031ca6a25b855820590c70 Added Reference https://git.kernel.org/stable/c/5401fb4fe10fac6134c308495df18ed74aebb9c4 Added Reference https://git.kernel.org/stable/c/8fb4a23df5b7c02929b62e5dbc270ec7c42b8134 Added Reference https://git.kernel.org/stable/c/d5de9cb5355db36438edc621dde3673e3f235767 Added Reference https://git.kernel.org/stable/c/d77583ca33299fede0c194744ef2284e7ba5b763