CVE-2026-74646
Description
A flaw was found in the Linux kernel's fastrpc subsystem. When an invoke operation is interrupted by a signal, the fastrpc_internal_invoke() function moves memory mappings without properly holding the fl->lock. This missing lock during memory map manipulation creates a race condition, which could lead to memory corruption or system instability.
Statement
Red Hat Enterprise Linux and Red Hat In-Vehicle OS are not affected by this moderate-severity Linux kernel flaw because the vulnerable code is not present in the shipped kernel packages. The upstream flaw is a race condition in the fastrpc subsystem: when an invoke is interrupted by a signal, fastrpc_internal_invoke() moves every buffer from fl->mmaps onto cctx->invoke_interrupted_mmaps using list_del()/list_add_tail() without holding fl->lock, the lock that serialises fl->mmaps in every other accessor. A local low-privileged attacker able to issue fastrpc requests could race this unlocked list walk against a concurrent mmap or munmap operation, resulting in kernel memory corruption, system instability, or a crash (denial of service). Red Hat rates this issue MODERATE with an availability-only impact (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), lower than the 7.8 severity in the upstream CVE record, because no path to controlled confidentiality or integrity impact has been established for this race condition.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | 7.8 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | High |
| Integrity Impact | None | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
