CVE-2026-63797 (GCVE-0-2026-63797)

Vulnerability from cvelistv5 – Published: 2026-07-19 12:02 – Updated: 2026-08-05 12:35
VLAI
Title
rpmsg: char: Fix use-after-free on probe error path
Summary
In the Linux kernel, the following vulnerability has been resolved: rpmsg: char: Fix use-after-free on probe error path rpmsg_chrdev_probe() stores the newly allocated eptdev in the default endpoint's priv pointer before calling rpmsg_chrdev_eptdev_add(). If rpmsg_chrdev_eptdev_add() then fails, its error path frees eptdev while the default endpoint may still dispatch callbacks with the stale priv pointer. Avoid publishing eptdev through the default endpoint until rpmsg_chrdev_eptdev_add() succeeds. Messages received before the priv pointer is published should be ignored by rpmsg_ept_cb(). Flow-control updates can hit rpmsg_ept_flow_cb() in the same window, so make both callbacks return success when priv is NULL.
Severity
8.4 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: bc69d10665690492421d926b1cd9a7a36bffd691 , < 1306fc4f76f765727a6d5aefbf08ef0c8f32996f (git)
Affected: bc69d10665690492421d926b1cd9a7a36bffd691 , < ddf13f91ca82c94ef7ad9c41a434a03313f8eb1b (git)
Affected: bc69d10665690492421d926b1cd9a7a36bffd691 , < c5ebb06c7e24d531b68707168e04698859d642bc (git)
Affected: bc69d10665690492421d926b1cd9a7a36bffd691 , < 104d100212396801f1d9d388282f746e23e2bfd6 (git)
Affected: bc69d10665690492421d926b1cd9a7a36bffd691 , < ff268cd9ccbce6472a0658791b417bf11c31ee39 (git)
Affected: bc69d10665690492421d926b1cd9a7a36bffd691 , < 1ff3f528e67d20e2b1483dcaba899dc7832b2e6b (git)
Create a notification for this product.
Linux Linux Affected: 5.18
Unaffected: 0 , < 5.18 (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.144 , ≤ 6.6.* (semver)
Unaffected: 6.12.95 , ≤ 6.12.* (semver)
Unaffected: 6.18.38 , ≤ 6.18.* (semver)
Unaffected: 7.1.3 , ≤ 7.1.* (semver)
Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/rpmsg/rpmsg_char.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1306fc4f76f765727a6d5aefbf08ef0c8f32996f",
              "status": "affected",
              "version": "bc69d10665690492421d926b1cd9a7a36bffd691",
              "versionType": "git"
            },
            {
              "lessThan": "ddf13f91ca82c94ef7ad9c41a434a03313f8eb1b",
              "status": "affected",
              "version": "bc69d10665690492421d926b1cd9a7a36bffd691",
              "versionType": "git"
            },
            {
              "lessThan": "c5ebb06c7e24d531b68707168e04698859d642bc",
              "status": "affected",
              "version": "bc69d10665690492421d926b1cd9a7a36bffd691",
              "versionType": "git"
            },
            {
              "lessThan": "104d100212396801f1d9d388282f746e23e2bfd6",
              "status": "affected",
              "version": "bc69d10665690492421d926b1cd9a7a36bffd691",
              "versionType": "git"
            },
            {
              "lessThan": "ff268cd9ccbce6472a0658791b417bf11c31ee39",
              "status": "affected",
              "version": "bc69d10665690492421d926b1cd9a7a36bffd691",
              "versionType": "git"
            },
            {
              "lessThan": "1ff3f528e67d20e2b1483dcaba899dc7832b2e6b",
              "status": "affected",
              "version": "bc69d10665690492421d926b1cd9a7a36bffd691",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/rpmsg/rpmsg_char.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.144",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.38",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.144",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.95",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.38",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.3",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2-rc1",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrpmsg: char: Fix use-after-free on probe error path\n\nrpmsg_chrdev_probe() stores the newly allocated eptdev in the default\nendpoint\u0027s priv pointer before calling rpmsg_chrdev_eptdev_add(). If\nrpmsg_chrdev_eptdev_add() then fails, its error path frees eptdev while\nthe default endpoint may still dispatch callbacks with the stale priv\npointer.\n\nAvoid publishing eptdev through the default endpoint until\nrpmsg_chrdev_eptdev_add() succeeds. Messages received before the priv\npointer is published should be ignored by rpmsg_ept_cb(). Flow-control\nupdates can hit rpmsg_ept_flow_cb() in the same window, so make both\ncallbacks return success when priv is NULL."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is in the rpmsg char driver and is reached when a coprocessor sends IPC messages over virtio/glink/SMD after announcing an rpmsg-raw channel; this is on-chip inter-processor communication, not a network-facing kernel protocol.\nAC:L - A compromised or malicious remote processor controls both channel announcements (to force probe failure via minor exhaustion) and the timing of inbound messages that invoke the stale priv pointer, making the race reliably attacker-driven.\nPR:N - Exploitation requires no Linux credentials; a compromised remote processor (modem, DSP, Cortex-M firmware) can announce rpmsg-raw channels and send messages without any local user or root access on the AP.\nUI:N - No victim user action is required; the remote processor initiates channel creation and message delivery autonomously through the rpmsg name service and messaging bus.\nS:U - The UAF corrupts kernel heap memory on the application processor, enabling privilege escalation within the kernel security boundary rather than crossing a VM or IOMMU isolation boundary.\nC:H - The use-after-free dereferences a freed kmalloc object to access queue_lock, skb queue heads, and wait queues, providing attacker-influenced heap reads that can be leveraged for arbitrary kernel memory disclosure.\nI:H - The UAF writes to fields in the freed rpmsg_eptdev structure (spinlock, skb queue, flow-control flags, wait queue), enabling heap corruption primitives that can be developed into arbitrary kernel writes or code execution.\nA:H - Use-after-free access to freed eptdev memory can cause kernel oops/panic from corrupting spinlocks and wait queues, and repeated triggering by the remote processor enables sustained denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:35:46.288Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1306fc4f76f765727a6d5aefbf08ef0c8f32996f"
        },
        {
          "url": "https://git.kernel.org/stable/c/ddf13f91ca82c94ef7ad9c41a434a03313f8eb1b"
        },
        {
          "url": "https://git.kernel.org/stable/c/c5ebb06c7e24d531b68707168e04698859d642bc"
        },
        {
          "url": "https://git.kernel.org/stable/c/104d100212396801f1d9d388282f746e23e2bfd6"
        },
        {
          "url": "https://git.kernel.org/stable/c/ff268cd9ccbce6472a0658791b417bf11c31ee39"
        },
        {
          "url": "https://git.kernel.org/stable/c/1ff3f528e67d20e2b1483dcaba899dc7832b2e6b"
        }
      ],
      "title": "rpmsg: char: Fix use-after-free on probe error path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63797",
    "datePublished": "2026-07-19T12:02:05.227Z",
    "dateReserved": "2026-07-19T07:54:57.012Z",
    "dateUpdated": "2026-08-05T12:35:46.288Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-63797",
      "date": "2026-08-10",
      "epss": "0.00146",
      "percentile": "0.04337"
    },
    "microsoft_vex": {
      "current_release_date": "2026-07-20T14:45:33.000Z",
      "cve": "CVE-2026-63797",
      "id": "msrc_CVE-2026-63797",
      "initial_release_date": "2026-07-20T01:06:36.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "rpmsg: char: Fix use-after-free on probe error path",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-63797.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-63797\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-19T12:16:52.190\",\"lastModified\":\"2026-07-30T17:35:28.350\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nrpmsg: char: Fix use-after-free on probe error path\\n\\nrpmsg_chrdev_probe() stores the newly allocated eptdev in the default\\nendpoint\u0027s priv pointer before calling rpmsg_chrdev_eptdev_add(). If\\nrpmsg_chrdev_eptdev_add() then fails, its error path frees eptdev while\\nthe default endpoint may still dispatch callbacks with the stale priv\\npointer.\\n\\nAvoid publishing eptdev through the default endpoint until\\nrpmsg_chrdev_eptdev_add() succeeds. Messages received before the priv\\npointer is published should be ignored by rpmsg_ept_cb(). Flow-control\\nupdates can hit rpmsg_ept_flow_cb() in the same window, so make both\\ncallbacks return success when priv is NULL.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/rpmsg/rpmsg_char.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"bc69d10665690492421d926b1cd9a7a36bffd691\",\"lessThan\":\"1306fc4f76f765727a6d5aefbf08ef0c8f32996f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bc69d10665690492421d926b1cd9a7a36bffd691\",\"lessThan\":\"ddf13f91ca82c94ef7ad9c41a434a03313f8eb1b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bc69d10665690492421d926b1cd9a7a36bffd691\",\"lessThan\":\"c5ebb06c7e24d531b68707168e04698859d642bc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bc69d10665690492421d926b1cd9a7a36bffd691\",\"lessThan\":\"104d100212396801f1d9d388282f746e23e2bfd6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bc69d10665690492421d926b1cd9a7a36bffd691\",\"lessThan\":\"ff268cd9ccbce6472a0658791b417bf11c31ee39\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bc69d10665690492421d926b1cd9a7a36bffd691\",\"lessThan\":\"1ff3f528e67d20e2b1483dcaba899dc7832b2e6b\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/rpmsg/rpmsg_char.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.178\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.144\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.95\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.38\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.3\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.4,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.5,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.4,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.5,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.18\",\"versionEndExcluding\":\"6.1.178\",\"matchCriteriaId\":\"43044073-5742-448F-B568-FA7A8A39ABDF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.144\",\"matchCriteriaId\":\"C8AD3BC8-C843-423C-B9DB-CB52F67F578E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.95\",\"matchCriteriaId\":\"4E206B86-E0E3-4394-A93F-39F2D50A8AA8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.38\",\"matchCriteriaId\":\"FA591B28-5D62-449E-BDBE-3C9391BF070A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"7.1.3\",\"matchCriteriaId\":\"9526B150-E2B3-4C6F-8AE5-1AF92B75AD9E\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/104d100212396801f1d9d388282f746e23e2bfd6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1306fc4f76f765727a6d5aefbf08ef0c8f32996f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1ff3f528e67d20e2b1483dcaba899dc7832b2e6b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c5ebb06c7e24d531b68707168e04698859d642bc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ddf13f91ca82c94ef7ad9c41a434a03313f8eb1b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ff268cd9ccbce6472a0658791b417bf11c31ee39\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-07-30T17:44:59+00:00",
      "cve": "CVE-2026-63797",
      "id": "CVE-2026-63797",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: rpmsg: char: Fix use-after-free on probe error path",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63797.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-21T23:48:06Z",
      "cve": "CVE-2026-63797",
      "id": "CVE-2026-63797",
      "initial_release_date": "2026-07-19T17:35:09Z",
      "product_status:known_affected": "119",
      "product_status:known_not_affected": "165",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-63797",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-63797.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.