Skip to content
CVE PROGRAM SOURCE RECORD8.4 High

CVE-2026-63797

rpmsg: char: Fix use-after-free on probe error path

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: rpmsg: char: Fix use-after-free on probe error path rpmsg_chrdev_probe() stores the newly allocated eptdev in the default endpoint's priv pointer before calling rpmsg_chrdev_eptdev_add(). If rpmsg_chrdev_eptdev_add() then fails, its error path frees eptdev while the default endpoint may still dispatch callbacks with the stale priv pointer. Avoid publishing eptdev through the default endpoint until rpmsg_chrdev_eptdev_add() succeeds. Messages received before the priv pointer is published should be ignored by rpmsg_ept_cb(). Flow-control updates can hit rpmsg_ept_flow_cb() in the same window, so make both callbacks return success when priv is NULL.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • bc69d10665690492421d926b1cd9a7a36bffd691 to < 1306fc4f76f765727a6d5aefbf08ef0c8f32996faffected
  • bc69d10665690492421d926b1cd9a7a36bffd691 to < ddf13f91ca82c94ef7ad9c41a434a03313f8eb1baffected
  • bc69d10665690492421d926b1cd9a7a36bffd691 to < c5ebb06c7e24d531b68707168e04698859d642bcaffected
  • bc69d10665690492421d926b1cd9a7a36bffd691 to < 104d100212396801f1d9d388282f746e23e2bfd6affected
  • bc69d10665690492421d926b1cd9a7a36bffd691 to < ff268cd9ccbce6472a0658791b417bf11c31ee39affected
  • bc69d10665690492421d926b1cd9a7a36bffd691 to < 1ff3f528e67d20e2b1483dcaba899dc7832b2e6baffected

Linux Linux

Default version status: affected

  • 5.18affected
  • 0 to < 5.18unaffected
  • 6.1.178 to ≤ 6.1.*unaffected
  • 6.6.144 to ≤ 6.6.*unaffected
  • 6.12.95 to ≤ 6.12.*unaffected
  • 6.18.38 to ≤ 6.18.*unaffected
  • 7.1.3 to ≤ 7.1.*unaffected
  • 7.2 to ≤ *unaffected

References