Junglewise Threat Intelligence

CVE-2026-63797: Linux Kernel rpmsg use-after-free in rpmsg_chrdev_probe

CVE-2026-63797 · Severity: info · Published 2026-07-19

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's Remote Processor Messaging (rpmsg) character device driver. This component facilitates communication between the main processor and secondary processors in a system. A flaw during the initialization process could lead to a system crash or unpredictable behavior if the setup fails, potentially impacting system stability and availability.

Technical details

A use-after-free (UAF) vulnerability exists in drivers/rpmsg/rpmsg_char.c within the rpmsg_chrdev_probe() function. The root cause is a race condition where the 'eptdev' structure is assigned to the default endpoint's private pointer before the completion of rpmsg_chrdev_eptdev_add(). If rpmsg_chrdev_eptdev_add() fails, the error path frees 'eptdev', but the endpoint may still dispatch callbacks (rpmsg_ept_cb or rpmsg_ept_flow_cb) using the now-stale pointer. An attacker with local access could potentially trigger this condition to cause a kernel oops or memory corruption. The fix involves delaying the publication of the private pointer until after successful registration and adding NULL checks to the callbacks.

Affected products

  • Linux Linux Kernel 5.18 to 6.6.144, 6.12.95, 6.18.38, 7.1.3

Timeline

  • 2026-06-01: other: Patch submitted by developer
  • 2026-07-19: advisory: CVE published by NVD/Kernel.org

References

Related threats