The vulnerability in the Linux kernel's rpmsg character device driver involves a use-after-free condition on the probe error path. Specifically, rpmsg_chrdev_probe() stores the newly allocated endpoint device (eptdev) in the default endpoint's private pointer before calling rpmsg_chrdev_eptdev_add(). If rpmsg_chrdev_eptdev_add() fails, it frees eptdev, but the default endpoint may still dispatch callbacks referencing the stale priv pointer, leading to use-after-free. The fix delays publishing eptdev through the default endpoint until rpmsg_chrdev_eptdev_add() succeeds, and modifies callbacks to safely handle the case when priv is NULL.

The use-after-free vulnerability could allow kernel memory corruption if callbacks access freed memory, potentially leading to system instability or escalation of privileges. However, no known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to address this issue by changing the order of publishing the endpoint device and handling callbacks safely. Users should update to the fixed kernel version once available. Patch status is not yet confirmed; check the official Linux kernel advisories or vendor updates for current remediation guidance.