The Linux kernel’s fastrpc subsystem incorrectly used find_vma to locate a user‑supplied pointer when computing a DMA address offset. If the pointer fell in the gap before the returned VMA, the subtraction could underflow, corrupting the DMA address sent to the DSP. This flaw allows an attacker to influence the DMA mapping, potentially leading to data corruption or exposure, and is related to integer underflow (CWE‑191).

The vulnerability affects any Linux kernel build that contains the fastrpc module without the commit that replaces find_vma() with vma_lookup(). It applies to all supported architectures that use fastrpc for DMA operations in the mainline kernel.

The CVSS score of 8.8 indicates high severity, and the EPSS score of < 1% suggests exploitation is unlikely at present; the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector requires local or elevated privileges to invoke fastrpc with a crafted pointer, and injection of kernel‑level exploits remains the primary means of exploitation. No publicly documented exploits are known.