CVE-2026-63797 (GCVE-0-2026-63797)
Vulnerability from cvelistv5
Published
2026-07-19 12:02
Modified
2026-08-17 04:51
Severity ?
8.4 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: rpmsg: char: Fix use-after-free on probe error path rpmsg_chrdev_probe() stores the newly allocated eptdev in the default endpoint's priv pointer before calling rpmsg_chrdev_eptdev_add(). If rpmsg_chrdev_eptdev_add() then fails, its error path frees eptdev while the default endpoint may still dispatch callbacks with the stale priv pointer. Avoid publishing eptdev through the default endpoint until rpmsg_chrdev_eptdev_add() succeeds. Messages received before the priv pointer is published should be ignored by rpmsg_ept_cb(). Flow-control updates can hit rpmsg_ept_flow_cb() in the same window, so make both callbacks return success when priv is NULL.
References
Impacted products
Vendor Product Version
Linux Linux Version: bc69d10665690492421d926b1cd9a7a36bffd691
Version: bc69d10665690492421d926b1cd9a7a36bffd691
Version: bc69d10665690492421d926b1cd9a7a36bffd691
Version: bc69d10665690492421d926b1cd9a7a36bffd691
Version: bc69d10665690492421d926b1cd9a7a36bffd691
Version: bc69d10665690492421d926b1cd9a7a36bffd691
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/rpmsg/rpmsg_char.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1306fc4f76f765727a6d5aefbf08ef0c8f32996f",
              "status": "affected",
              "version": "bc69d10665690492421d926b1cd9a7a36bffd691",
              "versionType": "git"
            },
            {
              "lessThan": "ddf13f91ca82c94ef7ad9c41a434a03313f8eb1b",
              "status": "affected",
              "version": "bc69d10665690492421d926b1cd9a7a36bffd691",
              "versionType": "git"
            },
            {
              "lessThan": "c5ebb06c7e24d531b68707168e04698859d642bc",
              "status": "affected",
              "version": "bc69d10665690492421d926b1cd9a7a36bffd691",
              "versionType": "git"
            },
            {
              "lessThan": "104d100212396801f1d9d388282f746e23e2bfd6",
              "status": "affected",
              "version": "bc69d10665690492421d926b1cd9a7a36bffd691",
              "versionType": "git"
            },
            {
              "lessThan": "ff268cd9ccbce6472a0658791b417bf11c31ee39",
              "status": "affected",
              "version": "bc69d10665690492421d926b1cd9a7a36bffd691",
              "versionType": "git"
            },
            {
              "lessThan": "1ff3f528e67d20e2b1483dcaba899dc7832b2e6b",
              "status": "affected",
              "version": "bc69d10665690492421d926b1cd9a7a36bffd691",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/rpmsg/rpmsg_char.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.144",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.38",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.144",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.95",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.38",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.3",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrpmsg: char: Fix use-after-free on probe error path\n\nrpmsg_chrdev_probe() stores the newly allocated eptdev in the default\nendpoint\u0027s priv pointer before calling rpmsg_chrdev_eptdev_add(). If\nrpmsg_chrdev_eptdev_add() then fails, its error path frees eptdev while\nthe default endpoint may still dispatch callbacks with the stale priv\npointer.\n\nAvoid publishing eptdev through the default endpoint until\nrpmsg_chrdev_eptdev_add() succeeds. Messages received before the priv\npointer is published should be ignored by rpmsg_ept_cb(). Flow-control\nupdates can hit rpmsg_ept_flow_cb() in the same window, so make both\ncallbacks return success when priv is NULL."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is in the rpmsg char driver and is reached when a coprocessor sends IPC messages over virtio/glink/SMD after announcing an rpmsg-raw channel; this is on-chip inter-processor communication, not a network-facing kernel protocol.\nAC:L - A compromised or malicious remote processor controls both channel announcements (to force probe failure via minor exhaustion) and the timing of inbound messages that invoke the stale priv pointer, making the race reliably attacker-driven.\nPR:N - Exploitation requires no Linux credentials; a compromised remote processor (modem, DSP, Cortex-M firmware) can announce rpmsg-raw channels and send messages without any local user or root access on the AP.\nUI:N - No victim user action is required; the remote processor initiates channel creation and message delivery autonomously through the rpmsg name service and messaging bus.\nS:U - The UAF corrupts kernel heap memory on the application processor, enabling privilege escalation within the kernel security boundary rather than crossing a VM or IOMMU isolation boundary.\nC:H - The use-after-free dereferences a freed kmalloc object to access queue_lock, skb queue heads, and wait queues, providing attacker-influenced heap reads that can be leveraged for arbitrary kernel memory disclosure.\nI:H - The UAF writes to fields in the freed rpmsg_eptdev structure (spinlock, skb queue, flow-control flags, wait queue), enabling heap corruption primitives that can be developed into arbitrary kernel writes or code execution.\nA:H - Use-after-free access to freed eptdev memory can cause kernel oops/panic from corrupting spinlocks and wait queues, and repeated triggering by the remote processor enables sustained denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:51:02.287Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1306fc4f76f765727a6d5aefbf08ef0c8f32996f"
        },
        {
          "url": "https://git.kernel.org/stable/c/ddf13f91ca82c94ef7ad9c41a434a03313f8eb1b"
        },
        {
          "url": "https://git.kernel.org/stable/c/c5ebb06c7e24d531b68707168e04698859d642bc"
        },
        {
          "url": "https://git.kernel.org/stable/c/104d100212396801f1d9d388282f746e23e2bfd6"
        },
        {
          "url": "https://git.kernel.org/stable/c/ff268cd9ccbce6472a0658791b417bf11c31ee39"
        },
        {
          "url": "https://git.kernel.org/stable/c/1ff3f528e67d20e2b1483dcaba899dc7832b2e6b"
        }
      ],
      "title": "rpmsg: char: Fix use-after-free on probe error path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63797",
    "datePublished": "2026-07-19T12:02:05.227Z",
    "dateReserved": "2026-07-19T07:54:57.012Z",
    "dateUpdated": "2026-08-17T04:51:02.287Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.