In the Linux kernel, the following vulnerability has been resolved: rpmsg: char: Fix use-after-free on probe error path rpmsg_chrdev_probe() stores… (CVE-2026-63797)
In the Linux kernel, the following vulnerability has been resolved: rpmsg: char: Fix use-after-free on probe error path rpmsg_chrdev_probe() stores the newly allocated eptdev in the default endpoint's priv pointer before calling rpmsg_chrdev_eptdev_add(). If rpmsg_chrdev_eptdev_add() then fails, its error path frees eptdev while the default endpoint may still dispatch callbacks with the stale priv pointer. Avoid publishing eptdev through the default endpoint until rpmsg_chrdev_eptdev_add() succeeds. Messages received before the priv pointer is published should be ignored by rpmsg_ept_cb(). Flow-control updates can hit rpmsg_ept_flow_cb() in the same window, so make both callbacks return success when priv is NULL.
AI Analysis
Technical Summary
The vulnerability in the Linux kernel's rpmsg character device driver involves a use-after-free condition on the probe error path. Specifically, rpmsg_chrdev_probe() stores the newly allocated endpoint device (eptdev) in the default endpoint's private pointer before calling rpmsg_chrdev_eptdev_add(). If rpmsg_chrdev_eptdev_add() fails, it frees eptdev, but the default endpoint may still dispatch callbacks referencing the stale priv pointer, leading to use-after-free. The fix delays publishing eptdev through the default endpoint until rpmsg_chrdev_eptdev_add() succeeds, and modifies callbacks to safely handle the case when priv is NULL.
Potential Impact
The use-after-free vulnerability could allow kernel memory corruption if callbacks access freed memory, potentially leading to system instability or escalation of privileges. However, no known exploits in the wild have been reported.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to address this issue by changing the order of publishing the endpoint device and handling callbacks safely. Users should update to the fixed kernel version once available. Patch status is not yet confirmed; check the official Linux kernel advisories or vendor updates for current remediation guidance.
In the Linux kernel, the following vulnerability has been resolved: rpmsg: char: Fix use-after-free on probe error path rpmsg_chrdev_probe() stores… (CVE-2026-63797)
Description
In the Linux kernel, the following vulnerability has been resolved: rpmsg: char: Fix use-after-free on probe error path rpmsg_chrdev_probe() stores the newly allocated eptdev in the default endpoint's priv pointer before calling rpmsg_chrdev_eptdev_add(). If rpmsg_chrdev_eptdev_add() then fails, its error path frees eptdev while the default endpoint may still dispatch callbacks with the stale priv pointer. Avoid publishing eptdev through the default endpoint until rpmsg_chrdev_eptdev_add() succeeds. Messages received before the priv pointer is published should be ignored by rpmsg_ept_cb(). Flow-control updates can hit rpmsg_ept_flow_cb() in the same window, so make both callbacks return success when priv is NULL.
CVSS v3.1
Score 8.4high
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in the Linux kernel's rpmsg character device driver involves a use-after-free condition on the probe error path. Specifically, rpmsg_chrdev_probe() stores the newly allocated endpoint device (eptdev) in the default endpoint's private pointer before calling rpmsg_chrdev_eptdev_add(). If rpmsg_chrdev_eptdev_add() fails, it frees eptdev, but the default endpoint may still dispatch callbacks referencing the stale priv pointer, leading to use-after-free. The fix delays publishing eptdev through the default endpoint until rpmsg_chrdev_eptdev_add() succeeds, and modifies callbacks to safely handle the case when priv is NULL.
Potential Impact
The use-after-free vulnerability could allow kernel memory corruption if callbacks access freed memory, potentially leading to system instability or escalation of privileges. However, no known exploits in the wild have been reported.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to address this issue by changing the order of publishing the endpoint device and handling callbacks safely. Users should update to the fixed kernel version once available. Patch status is not yet confirmed; check the official Linux kernel advisories or vendor updates for current remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-86gp-v777-h747
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-63797"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- 3.1
Threat ID: 6a5d27ad2a4a8d5989131c1a
Added to database: 07/19/2026, 19:38:21 UTC
Last enriched: 07/19/2026, 20:21:40 UTC
Last updated: 08/29/2026, 10:52:10 UTC
Views: 76
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.