Executive brief
A vulnerability was identified in the Linux kernel's Remote Processor Messaging (rpmsg) framework, which manages communication between different processors on a single chip. A flaw in how the system handles driver configuration allows a race condition that could lead to a system crash or unauthorized memory access. This could potentially be used by a local attacker to disrupt operations or gain elevated privileges on the affected system.
Technical details
A race condition exists in the rpmsg core component of the Linux kernel. The 'driver_override_show' function reads the 'driver_override' string without acquiring the 'device_lock', while the corresponding store function can modify and free that same string while holding the lock. This lack of synchronization leads to a use-after-free (UAF) vulnerability. A local attacker with access to sysfs attributes can trigger this race by simultaneously reading and writing to the driver_override attribute. The fix involves implementing proper locking in the show function and migrating to the standard 'driver_set_override' helper. Patching is available in various stable kernel branches including 5.10.y, 5.15.y, 6.1.y, and newer.
Affected products
- Linux Linux kernel 4.18 to 6.13.y
Timeline
- 2025-12-03: other: Vulnerability fix authored
- 2026-05-06: advisory: CVE published
References
- https://git.kernel.org/stable/c/2e4a70f3c30910427e5ea848b799066d67b963d5
- https://git.kernel.org/stable/c/392c6b68334aa0e0ae9aba95c0a366bcb0d92f5d
- https://git.kernel.org/stable/c/42023d4b6d2661a40ee2dcf7e1a3528a35c638ca
- https://git.kernel.org/stable/c/47615557447185917afa432b7958f87583c417cb
- https://git.kernel.org/stable/c/7654e6e3cd6bdee9602f6063b3c670bd556d7e61
- https://git.kernel.org/stable/c/90c8353f471821d7ccd4fe573a2402e056192494
- https://git.kernel.org/stable/c/954557957177c3c13d7c655976665b1170da5e50