The Linux kernel's fastrpc subsystem contains a timing flaw in the unmap routine. The buffer entry is removed from its internal list only after the DSP has completed the unmap operation. When multiple threads issue unmap calls concurrently, one thread may delete the buffer record while another is still performing the unmap, leading to inconsistent tracker state. This race can corrupt kernel memory or cause kernel panics, resulting in system instability or denial of service.

All Linux kernel builds that ship with the fastrpc subsystem are potentially affected, because the vulnerability resides in kernel core code. The advisory does not list specific kernel versions, so any build containing the unpatched fastrpc implementation is at risk. Users of mainstream distributions or custom kernels should verify whether their kernel includes the fastrpc code and whether the bug‑fix commit is present. No explicit version constraints are provided; therefore, a conservative approach is to treat all fastrpc‑capable kernels as affected until verified otherwise.

The flaw manifests only under concurrent use of the unmap API, which limits the attack surface to local situations where an attacker can trigger simultaneous unmap operations. The EPSS score is less than 1 %, indicating a very low but non‑zero exploitation likelihood. The CVSS score of 7.8 reflects high severity. Because the vulnerability is not listed in CISA KEV, no widespread exploitation has been documented. An attacker with local or kernel‑level privileges that can invoke the fastrpc interface could trigger the race, potentially leading to memory corruption or a kernel panic, effectively causing a denial of service. The likely attack vector is local.