CVE-2026-31730: misc: fastrpc: possible double-free of cctx->remote_heap
In the Linux kernel, the following vulnerability has been resolved:
misc: fastrpc: possible double-free of cctx->remoteheap
fastrpcinitcreatestaticprocess() may free cctx->remoteheap on the errmap path but does not clear the pointer. Later, fastrpcrpmsgremove() frees cctx->remoteheap again if it is non-NULL, which can lead to a double-free if the INITCREATESTATIC ioctl hits the error path and the rpmsg device is subsequently removed/unbound. Clear cctx->remoteheap after freeing it in the error path to prevent the later cleanup from freeing it again.
This issue was found by an in-house analysis workflow that extracts AST-based information and runs static checks, with LLM assistance for triage, and was confirmed by manual code review. No hardware testing was performed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In fastrpc_init_create_static_process(), after freeing cctx->remote_heap on the INIT_CREATE_STATIC ioctl error path, clear the pointer (set cctx->remote_heap = NULL) so that the later cleanup (including fastrpc_rpmsg_remove() / err_map path) does not double-free it.
Linux kernel (misc: fastrpc) cctx->remote_heap cleanup in error path = Set cctx->remote_heap to NULL after freeing it on the INIT_CREATE_STATIC ioctl error path