8.4

CVE-2026-63797

rpmsg: char: Fix use-after-free on probe error path

In the Linux kernel, the following vulnerability has been resolved:

rpmsg: char: Fix use-after-free on probe error path

rpmsg_chrdev_probe() stores the newly allocated eptdev in the default
endpoint's priv pointer before calling rpmsg_chrdev_eptdev_add(). If
rpmsg_chrdev_eptdev_add() then fails, its error path frees eptdev while
the default endpoint may still dispatch callbacks with the stale priv
pointer.

Avoid publishing eptdev through the default endpoint until
rpmsg_chrdev_eptdev_add() succeeds. Messages received before the priv
pointer is published should be ignored by rpmsg_ept_cb(). Flow-control
updates can hit rpmsg_ept_flow_cb() in the same window, so make both
callbacks return success when priv is NULL.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 5.18 < 6.1.178
Linux ≫ Linux Kernel Version >= 6.2 < 6.6.144
Linux ≫ Linux Kernel Version >= 6.7 < 6.12.95
Linux ≫ Linux Kernel Version >= 6.13 < 6.18.38
Linux ≫ Linux Kernel Version >= 6.19 < 7.1.3
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.15% 0.043
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.4 2.5 5.9
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
416baaa9-dc9f-4396-8d5f-8c081fb06d67 8.4 2.5 5.9
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

https://git.kernel.org/stable/c/ddf13f91ca82c94ef7ad9c41a434a03313f8eb1b
Patch
https://git.kernel.org/stable/c/c5ebb06c7e24d531b68707168e04698859d642bc
Patch
https://git.kernel.org/stable/c/104d100212396801f1d9d388282f746e23e2bfd6
Patch
https://git.kernel.org/stable/c/ff268cd9ccbce6472a0658791b417bf11c31ee39
Patch
https://git.kernel.org/stable/c/1ff3f528e67d20e2b1483dcaba899dc7832b2e6b
Patch
https://git.kernel.org/stable/c/1306fc4f76f765727a6d5aefbf08ef0c8f32996f
Patch