CVE-2026-74646

A flaw was found in the Linux kernel's fastrpc subsystem. When an invoke operation is interrupted by a signal, the fastrpc_internal_invoke() function moves memory mappings without properly holding the fl->lock. This missing lock during memory map manipulation creates a race condition, which could lead to memory corruption or system instability.

Red Hat Enterprise Linux and Red Hat In-Vehicle OS are not affected by this moderate-severity Linux kernel flaw because the vulnerable code is not present in the shipped kernel packages. The upstream flaw is a race condition in the fastrpc subsystem: when an invoke is interrupted by a signal, fastrpc_internal_invoke() moves every buffer from fl->mmaps onto cctx->invoke_interrupted_mmaps using list_del()/list_add_tail() without holding fl->lock, the lock that serialises fl->mmaps in every other accessor. A local low-privileged attacker able to issue fastrpc requests could race this unlocked list walk against a concurrent mmap or munmap operation, resulting in kernel memory corruption, system instability, or a crash (denial of service). Red Hat rates this issue MODERATE with an availability-only impact (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), lower than the 7.8 severity in the upstream CVE record, because no path to controlled confidentiality or integrity impact has been established for this race condition.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.