CVE-2026-31730

What it actually does

This is a local Linux kernel memory-corruption flaw in the Qualcomm FastRPC driver. When fastrpc_init_create_static_process() handles an error during the INIT_CREATE_STATIC ioctl path, it can free cctx->remote_heap without clearing the pointer. If the associated rpmsg device is later removed or unbound, fastrpc_rpmsg_remove() may free the same pointer again. A double-free in kernel memory can cause a kernel crash and, depending on allocator state, may be exploitable for local privilege escalation or arbitrary kernel memory manipulation. The CVSS vector indicates local access with low attack complexity, required low privileges, no user interaction, and potential high confidentiality, integrity, and availability impact.

Why it matters to the business

Systems that expose the FastRPC device interface to local users or applications may be at risk of kernel crashes or possible local privilege escalation. Operationally, exploitation could disrupt Linux-based endpoints, embedded devices, mobile/edge platforms, or appliances using Qualcomm FastRPC/rpmsg functionality. The issue is not currently listed in CISA KEV, is not known to be used in ransomware, has no reported mature public exploit, and has a very low EPSS score with no 30-day upward trend, so broad internet-scale exploitation is unlikely; however, the business risk remains meaningful on multi-user systems or devices where untrusted applications can access FastRPC device nodes.

How an attack unfolds

An attacker first needs local code execution with sufficient permissions to open the FastRPC device interface. They then trigger the INIT_CREATE_STATIC ioctl in a way that reaches the vulnerable error path, causing the driver to free cctx->remote_heap while leaving a stale non-NULL pointer behind. The attacker must then cause or wait for the related rpmsg device to be removed, unbound, reset, or otherwise cleaned up. During that cleanup, fastrpc_rpmsg_remove() sees the stale pointer and frees it again. In the simplest case this produces a kernel oops, panic, or denial of service. With careful heap shaping and reliable control of allocator behavior, a skilled attacker may attempt to convert the double-free into privilege escalation or kernel memory corruption.

How to fix it

Apply a Linux kernel update from the relevant distribution, device vendor, or kernel maintainer that includes the FastRPC fix clearing cctx->remote_heap after it is freed in the error path. No exact fixed package versions were provided, so track vendor advisories and stable-kernel backports for CVE-2026-31730 or the FastRPC double-free fix. Where immediate patching is not possible, reduce exposure by disabling or removing the Qualcomm FastRPC driver if it is not required, building kernels without CONFIG_QCOM_FASTRPC where feasible, blocking module loading where applicable, and restricting permissions on /dev/fastrpc* device nodes so only trusted system services can access them. On systems where rpmsg/FastRPC is required, avoid allowing untrusted local users, containers, or applications direct access to the device interface.

How to confirm the fix worked

Confirm the running kernel is a vendor-fixed build or contains the source change that nulls cctx->remote_heap after it is freed in the fastrpc_init_create_static_process() err_map path. Validate that package management, kernel release notes, or vendor advisories identify the FastRPC double-free fix as included. On source-based builds, inspect the FastRPC driver code to ensure the freed remote_heap pointer is cleared before later cleanup paths can run. Confirm runtime exposure by checking whether the FastRPC driver is loaded, whether CONFIG_QCOM_FASTRPC is enabled, and whether /dev/fastrpc* nodes exist. Review udev rules and file permissions to ensure only trusted principals can access FastRPC devices. In test environments only, use kernel sanitizers such as KASAN or KFENCE to verify that exercising FastRPC error paths and rpmsg removal no longer produces double-free warnings or kernel oops messages.

Typical attack path

1. Gain local execution on a Linux system that includes the Qualcomm FastRPC kernel driver and exposes FastRPC device nodes.
2. Verify access to a FastRPC character device, such as a /dev/fastrpc* interface, with permissions usable by the attacker-controlled process.
3. Invoke the INIT_CREATE_STATIC ioctl with parameters or state that force fastrpc_init_create_static_process() down the vulnerable err_map cleanup path.
4. Cause cctx->remote_heap to be freed while the pointer remains uncleared.
5. Trigger, induce, or wait for rpmsg device removal, unbind, reset, or driver cleanup.
6. Cause fastrpc_rpmsg_remove() to free the stale cctx->remote_heap pointer a second time.
7. Leverage the resulting double-free for a kernel crash, denial of service, or potentially local privilege escalation if heap exploitation is reliable.

How to detect it

Look for signs of local interaction with FastRPC immediately before kernel instability. Relevant sources include kernel logs, system journal, auditd records for device-node access, udev logs, crash dumps, kdump/vmcore analysis, EDR process telemetry, and container runtime logs where device passthrough is used. Search for kernel oops, panic, slab allocator corruption, KASAN/KFENCE double-free reports, and FastRPC or rpmsg removal/unbind events. Correlate those events with processes opening /dev/fastrpc* or issuing ioctls to FastRPC devices shortly before the crash. On systems with auditd, monitor open/openat/ioctl activity against /dev/fastrpc* by non-system users. There are no known public threat actors, ransomware campaigns, or stable exploit indicators associated with this vulnerability, so detection should focus on behavioral artifacts: suspicious local access to FastRPC devices, repeated device unbind/reset activity, and kernel memory-corruption crashes mentioning fastrpc, rpmsg, remote_heap, or double-free.

• /dev/fastrpc
• /dev/fastrpc-adsp
• /dev/fastrpc-cdsp
• /dev/fastrpc-mdsp
• /dev/fastrpc-sdsp
• fastrpc
• qcom_fastrpc
• INIT_CREATE_STATIC
• fastrpc_init_create_static_process
• fastrpc_rpmsg_remove
• remote_heap
• KASAN: double-free
• KFENCE: memory corruption
• BUG: KASAN
• kernel BUG at
• slab-use-after-free
• double free
• rpmsg_remove
• unbind

What your security team should do

• Prioritize patching Linux systems, embedded devices, and appliances that expose Qualcomm FastRPC functionality to local users or third-party applications.
• Inventory systems for loaded FastRPC/rpmsg components and /dev/fastrpc* device nodes, especially on Qualcomm-based platforms.
• Restrict access to FastRPC device nodes to trusted system services until patched.
• Disable or remove the FastRPC driver on systems that do not require DSP/RPC functionality.
• Monitor kernel logs for FastRPC-related crashes, KASAN reports, allocator corruption, rpmsg unbind events, or unexpected reboots.
• Treat exploitation attempts as local post-compromise activity; investigate the source process and user account that accessed FastRPC immediately before any kernel crash.
• Because EPSS is low, KEV is false, and no mature exploit is reported, schedule remediation based on local exposure rather than internet-facing emergency response, but do not defer on multi-tenant or untrusted-application platforms.