Executive brief
A vulnerability was identified in the Linux kernel's Remote Processor Messaging (rpmsg) character device driver. This component facilitates communication between the main processor and secondary processors in a system. A flaw during the initialization process could lead to a system crash or unpredictable behavior if the setup fails, potentially impacting system stability and availability.
Technical details
A use-after-free (UAF) vulnerability exists in drivers/rpmsg/rpmsg_char.c within the rpmsg_chrdev_probe() function. The root cause is a race condition where the 'eptdev' structure is assigned to the default endpoint's private pointer before the completion of rpmsg_chrdev_eptdev_add(). If rpmsg_chrdev_eptdev_add() fails, the error path frees 'eptdev', but the endpoint may still dispatch callbacks (rpmsg_ept_cb or rpmsg_ept_flow_cb) using the now-stale pointer. An attacker with local access could potentially trigger this condition to cause a kernel oops or memory corruption. The fix involves delaying the publication of the private pointer until after successful registration and adding NULL checks to the callbacks.
Affected products
- Linux Linux Kernel 5.18 to 6.6.144, 6.12.95, 6.18.38, 7.1.3
Timeline
- 2026-06-01: other: Patch submitted by developer
- 2026-07-19: advisory: CVE published by NVD/Kernel.org
References
- https://git.kernel.org/stable/c/104d100212396801f1d9d388282f746e23e2bfd6
- https://git.kernel.org/stable/c/1ff3f528e67d20e2b1483dcaba899dc7832b2e6b
- https://git.kernel.org/stable/c/c5ebb06c7e24d531b68707168e04698859d642bc
- https://git.kernel.org/stable/c/ddf13f91ca82c94ef7ad9c41a434a03313f8eb1b
- https://git.kernel.org/stable/c/ff268cd9ccbce6472a0658791b417bf11c31ee39