CVE-2026-74647: misc: fastrpc: Remove buffer from list prior to unmap operation

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

misc: fastrpc: Remove buffer from list prior to unmap operation

fastrpc_req_munmap_impl() is called to unmap any buffer. The buffer is
getting removed from the list after it is unmapped from DSP. This can
create potential race conditions if multiple threads invoke unmap
concurrently, where one thread may remove the entry from the list while
another thread's unmap operation is still ongoing.

Fix this by removing the buffer entry from the list before calling the
unmap operation. If the unmap fails, the entry is re-added to the list
so that userspace can retry the unmap, or alternatively, the buffer
will be cleaned up during device release when the DSP process is torn
down and all DSP-side mappings are freed along with remaining buffers
in the list.

The Linux kernel CVE team has assigned CVE-2026-74647 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.5 with commit 2419e55e532de14fdf336e09e453aa2831c73a25 and fixed in 6.6.152 with commit 97273624f7b356eaf8261609a75cfcb8738a165a
	Issue introduced in 5.5 with commit 2419e55e532de14fdf336e09e453aa2831c73a25 and fixed in 6.12.104 with commit fe70329055977fc1e8dc6291318d0dd75470795a
	Issue introduced in 5.5 with commit 2419e55e532de14fdf336e09e453aa2831c73a25 and fixed in 6.18.45 with commit 9bf22a7d950cec2d1efeca7f16bb20fcca84c36a
	Issue introduced in 5.5 with commit 2419e55e532de14fdf336e09e453aa2831c73a25 and fixed in 7.1.9 with commit 0beaa9bd7eb10d9b5e6352ed5161f3f3bbd4c3c5
	Issue introduced in 5.5 with commit 2419e55e532de14fdf336e09e453aa2831c73a25 and fixed in 7.2 with commit 6102ceb4eab845743ee57acd3863fbd06e93c927

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74647
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/misc/fastrpc.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/97273624f7b356eaf8261609a75cfcb8738a165a
	https://git.kernel.org/stable/c/fe70329055977fc1e8dc6291318d0dd75470795a
	https://git.kernel.org/stable/c/9bf22a7d950cec2d1efeca7f16bb20fcca84c36a
	https://git.kernel.org/stable/c/0beaa9bd7eb10d9b5e6352ed5161f3f3bbd4c3c5
	https://git.kernel.org/stable/c/6102ceb4eab845743ee57acd3863fbd06e93c927