GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-71274 (GCVE-0-2025-71274)

Vulnerability from cvelistv5 – Published: 2026-05-06 11:27 – Updated: 2026-08-05 12:12
VLAI
Title
rpmsg: core: fix race in driver_override_show() and use core helper
Summary
In the Linux kernel, the following vulnerability has been resolved: rpmsg: core: fix race in driver_override_show() and use core helper The driver_override_show function reads the driver_override string without holding the device_lock. However, the store function modifies and frees the string while holding the device_lock. This creates a race condition where the string can be freed by the store function while being read by the show function, leading to a use-after-free. To fix this, replace the rpmsg_string_attr macro with explicit show and store functions. The new driver_override_store uses the standard driver_set_override helper. Since the introduction of driver_set_override, the comments in include/linux/rpmsg.h have stated that this helper must be used to set or clear driver_override, but the implementation was not updated until now. Because driver_set_override modifies and frees the string while holding the device_lock, the new driver_override_show now correctly holds the device_lock during the read operation to prevent the race. Additionally, since rpmsg_string_attr has only ever been used for driver_override, removing the macro simplifies the code.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 39e47767ec9b22f844c2a07c9d329256960d4021 , < 392c6b68334aa0e0ae9aba95c0a366bcb0d92f5d (git)
Affected: 39e47767ec9b22f844c2a07c9d329256960d4021 , < d66b8074c555e8abb0ae19eea1c9f3635498bdde (git)
Affected: 39e47767ec9b22f844c2a07c9d329256960d4021 , < 47615557447185917afa432b7958f87583c417cb (git)
Affected: 39e47767ec9b22f844c2a07c9d329256960d4021 , < 90c8353f471821d7ccd4fe573a2402e056192494 (git)
Affected: 39e47767ec9b22f844c2a07c9d329256960d4021 , < 7654e6e3cd6bdee9602f6063b3c670bd556d7e61 (git)
Affected: 39e47767ec9b22f844c2a07c9d329256960d4021 , < 2e4a70f3c30910427e5ea848b799066d67b963d5 (git)
Affected: 39e47767ec9b22f844c2a07c9d329256960d4021 , < 954557957177c3c13d7c655976665b1170da5e50 (git)
Affected: 39e47767ec9b22f844c2a07c9d329256960d4021 , < 42023d4b6d2661a40ee2dcf7e1a3528a35c638ca (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.18
Unaffected: 0 , < 4.18 (semver)
Unaffected: 5.10.252 , ≤ 5.10.* (semver)
Unaffected: 5.15.202 , ≤ 5.15.* (semver)
Unaffected: 6.1.165 , ≤ 6.1.* (semver)
Unaffected: 6.6.128 , ≤ 6.6.* (semver)
Unaffected: 6.12.75 , ≤ 6.12.* (semver)
Unaffected: 6.18.16 , ≤ 6.18.* (semver)
Unaffected: 6.19.6 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/rpmsg/rpmsg_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "392c6b68334aa0e0ae9aba95c0a366bcb0d92f5d",
              "status": "affected",
              "version": "39e47767ec9b22f844c2a07c9d329256960d4021",
              "versionType": "git"
            },
            {
              "lessThan": "d66b8074c555e8abb0ae19eea1c9f3635498bdde",
              "status": "affected",
              "version": "39e47767ec9b22f844c2a07c9d329256960d4021",
              "versionType": "git"
            },
            {
              "lessThan": "47615557447185917afa432b7958f87583c417cb",
              "status": "affected",
              "version": "39e47767ec9b22f844c2a07c9d329256960d4021",
              "versionType": "git"
            },
            {
              "lessThan": "90c8353f471821d7ccd4fe573a2402e056192494",
              "status": "affected",
              "version": "39e47767ec9b22f844c2a07c9d329256960d4021",
              "versionType": "git"
            },
            {
              "lessThan": "7654e6e3cd6bdee9602f6063b3c670bd556d7e61",
              "status": "affected",
              "version": "39e47767ec9b22f844c2a07c9d329256960d4021",
              "versionType": "git"
            },
            {
              "lessThan": "2e4a70f3c30910427e5ea848b799066d67b963d5",
              "status": "affected",
              "version": "39e47767ec9b22f844c2a07c9d329256960d4021",
              "versionType": "git"
            },
            {
              "lessThan": "954557957177c3c13d7c655976665b1170da5e50",
              "status": "affected",
              "version": "39e47767ec9b22f844c2a07c9d329256960d4021",
              "versionType": "git"
            },
            {
              "lessThan": "42023d4b6d2661a40ee2dcf7e1a3528a35c638ca",
              "status": "affected",
              "version": "39e47767ec9b22f844c2a07c9d329256960d4021",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/rpmsg/rpmsg_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.18"
            },
            {
              "lessThan": "4.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.252",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.202",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.252",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.202",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.165",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.128",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrpmsg: core: fix race in driver_override_show() and use core helper\n\nThe driver_override_show function reads the driver_override string\nwithout holding the device_lock. However, the store function modifies\nand frees the string while holding the device_lock. This creates a race\ncondition where the string can be freed by the store function while\nbeing read by the show function, leading to a use-after-free.\n\nTo fix this, replace the rpmsg_string_attr macro with explicit show and\nstore functions. The new driver_override_store uses the standard\ndriver_set_override helper. Since the introduction of\ndriver_set_override, the comments in include/linux/rpmsg.h have stated\nthat this helper must be used to set or clear driver_override, but the\nimplementation was not updated until now.\n\nBecause driver_set_override modifies and frees the string while holding\nthe device_lock, the new driver_override_show now correctly holds the\ndevice_lock during the read operation to prevent the race.\n\nAdditionally, since rpmsg_string_attr has only ever been used for\ndriver_override, removing the macro simplifies the code."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Triggering uses concurrent read and write operations on the local rpmsg driver_override sysfs attribute; remote rpmsg traffic does not directly reach the vulnerable show function.\nAC:L - Separate sysfs opens have only per-open locking, allowing concurrent loops to force the load-versus-free window repeatedly. Stress testing reproduced the race, and a principal controlling both operations needs no external condition.\nPR:L - The attribute is world-readable at mode 0644, and the original report demonstrated pointer leakage to unprivileged readers. Although direct writes are root-owned, delegated rpmsg management is reasonable in embedded deployments, making low privileges the higher defensible value.\nUI:N - Once an rpmsg device exists, attacker-driven concurrent sysfs operations require no action from another user.\nS:U - The vulnerable callbacks and affected memory are within the same host kernel security authority; no VM, IOMMU, or other scope boundary is crossed.\nC:H - The freed string is consumed as an unbounded string and returned through sysfs, with stress testing leaking pointer-like kernel bytes. Heap reuse can expose additional kernel memory, making high confidentiality impact appropriate for this UAF.\nI:H - The stale string is formatted with unbounded sprintf into a PAGE_SIZE buffer; unterminated reclaimed data, or a maximum-sized override, can overrun that buffer. This kernel out-of-bounds write can corrupt adjacent memory and potentially enable control-flow hijacking.\nA:H - The UAF was reproduced under KASAN, and invalid stale-memory access or resulting buffer corruption can cause a kernel oops or panic repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:12:39.142Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/392c6b68334aa0e0ae9aba95c0a366bcb0d92f5d"
        },
        {
          "url": "https://git.kernel.org/stable/c/d66b8074c555e8abb0ae19eea1c9f3635498bdde"
        },
        {
          "url": "https://git.kernel.org/stable/c/47615557447185917afa432b7958f87583c417cb"
        },
        {
          "url": "https://git.kernel.org/stable/c/90c8353f471821d7ccd4fe573a2402e056192494"
        },
        {
          "url": "https://git.kernel.org/stable/c/7654e6e3cd6bdee9602f6063b3c670bd556d7e61"
        },
        {
          "url": "https://git.kernel.org/stable/c/2e4a70f3c30910427e5ea848b799066d67b963d5"
        },
        {
          "url": "https://git.kernel.org/stable/c/954557957177c3c13d7c655976665b1170da5e50"
        },
        {
          "url": "https://git.kernel.org/stable/c/42023d4b6d2661a40ee2dcf7e1a3528a35c638ca"
        }
      ],
      "title": "rpmsg: core: fix race in driver_override_show() and use core helper",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-71274",
    "datePublished": "2026-05-06T11:27:07.525Z",
    "dateReserved": "2026-03-17T09:08:18.458Z",
    "dateUpdated": "2026-08-05T12:12:39.142Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-71274",
      "date": "2026-09-16",
      "epss": "0.00099",
      "percentile": "0.00924"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-71274\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-06T12:16:27.447\",\"lastModified\":\"2026-07-30T06:24:57.103\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nrpmsg: core: fix race in driver_override_show() and use core helper\\n\\nThe driver_override_show function reads the driver_override string\\nwithout holding the device_lock. However, the store function modifies\\nand frees the string while holding the device_lock. This creates a race\\ncondition where the string can be freed by the store function while\\nbeing read by the show function, leading to a use-after-free.\\n\\nTo fix this, replace the rpmsg_string_attr macro with explicit show and\\nstore functions. The new driver_override_store uses the standard\\ndriver_set_override helper. Since the introduction of\\ndriver_set_override, the comments in include/linux/rpmsg.h have stated\\nthat this helper must be used to set or clear driver_override, but the\\nimplementation was not updated until now.\\n\\nBecause driver_set_override modifies and frees the string while holding\\nthe device_lock, the new driver_override_show now correctly holds the\\ndevice_lock during the read operation to prevent the race.\\n\\nAdditionally, since rpmsg_string_attr has only ever been used for\\ndriver_override, removing the macro simplifies the code.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/rpmsg/rpmsg_core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"39e47767ec9b22f844c2a07c9d329256960d4021\",\"lessThan\":\"392c6b68334aa0e0ae9aba95c0a366bcb0d92f5d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"39e47767ec9b22f844c2a07c9d329256960d4021\",\"lessThan\":\"d66b8074c555e8abb0ae19eea1c9f3635498bdde\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"39e47767ec9b22f844c2a07c9d329256960d4021\",\"lessThan\":\"47615557447185917afa432b7958f87583c417cb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"39e47767ec9b22f844c2a07c9d329256960d4021\",\"lessThan\":\"90c8353f471821d7ccd4fe573a2402e056192494\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"39e47767ec9b22f844c2a07c9d329256960d4021\",\"lessThan\":\"7654e6e3cd6bdee9602f6063b3c670bd556d7e61\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"39e47767ec9b22f844c2a07c9d329256960d4021\",\"lessThan\":\"2e4a70f3c30910427e5ea848b799066d67b963d5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"39e47767ec9b22f844c2a07c9d329256960d4021\",\"lessThan\":\"954557957177c3c13d7c655976665b1170da5e50\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"39e47767ec9b22f844c2a07c9d329256960d4021\",\"lessThan\":\"42023d4b6d2661a40ee2dcf7e1a3528a35c638ca\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/rpmsg/rpmsg_core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.252\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.202\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.165\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.128\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.75\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.16\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.6\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.18\",\"versionEndExcluding\":\"5.10.252\",\"matchCriteriaId\":\"90CED5DE-987F-4B30-AABF-64E292D6F3B5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.202\",\"matchCriteriaId\":\"4002FC2B-1456-4666-B240-0EBF590C4671\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.165\",\"matchCriteriaId\":\"797C7F46-D0BE-4FB8-A502-C5EF8E6B6654\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.128\",\"matchCriteriaId\":\"851E9353-6C09-4CC9-877E-E09DB164A3C2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.75\",\"matchCriteriaId\":\"BCE16369-98ED-41CF-8995-DFDC10B288D2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.16\",\"matchCriteriaId\":\"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.6\",\"matchCriteriaId\":\"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2e4a70f3c30910427e5ea848b799066d67b963d5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/392c6b68334aa0e0ae9aba95c0a366bcb0d92f5d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/42023d4b6d2661a40ee2dcf7e1a3528a35c638ca\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/47615557447185917afa432b7958f87583c417cb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7654e6e3cd6bdee9602f6063b3c670bd556d7e61\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/90c8353f471821d7ccd4fe573a2402e056192494\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/954557957177c3c13d7c655976665b1170da5e50\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d66b8074c555e8abb0ae19eea1c9f3635498bdde\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T08:32:15+00:00",
      "cve": "CVE-2025-71274",
      "id": "CVE-2025-71274",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: rpmsg: core: fix race in driver_override_show() and use core helper",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-71274.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-12T16:43:50Z",
      "cve": "CVE-2025-71274",
      "id": "CVE-2025-71274",
      "initial_release_date": "2026-05-09T02:48:29Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "578",
      "product_status:known_not_affected": "140",
      "product_status:recommended": "250",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-71274",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-71274.json",
      "version": "16"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.