Linux Kernel rpmsg_chrdev Use-After-Free on Probe
CVE-2026-63797 Published on July 19, 2026
rpmsg: char: Fix use-after-free on probe error path
In the Linux kernel, the following vulnerability has been resolved:
rpmsg: char: Fix use-after-free on probe error path
rpmsg_chrdev_probe() stores the newly allocated eptdev in the default
endpoint's priv pointer before calling rpmsg_chrdev_eptdev_add(). If
rpmsg_chrdev_eptdev_add() then fails, its error path frees eptdev while
the default endpoint may still dispatch callbacks with the stale priv
pointer.
Avoid publishing eptdev through the default endpoint until
rpmsg_chrdev_eptdev_add() succeeds. Messages received before the priv
pointer is published should be ignored by rpmsg_ept_cb(). Flow-control
updates can hit rpmsg_ept_flow_cb() in the same window, so make both
callbacks return success when priv is NULL.
Products Associated with CVE-2026-63797
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version bc69d10665690492421d926b1cd9a7a36bffd691 and below 1306fc4f76f765727a6d5aefbf08ef0c8f32996f is affected.
- Version bc69d10665690492421d926b1cd9a7a36bffd691 and below ddf13f91ca82c94ef7ad9c41a434a03313f8eb1b is affected.
- Version bc69d10665690492421d926b1cd9a7a36bffd691 and below c5ebb06c7e24d531b68707168e04698859d642bc is affected.
- Version bc69d10665690492421d926b1cd9a7a36bffd691 and below 104d100212396801f1d9d388282f746e23e2bfd6 is affected.
- Version bc69d10665690492421d926b1cd9a7a36bffd691 and below ff268cd9ccbce6472a0658791b417bf11c31ee39 is affected.
- Version bc69d10665690492421d926b1cd9a7a36bffd691 and below 1ff3f528e67d20e2b1483dcaba899dc7832b2e6b is affected.
- Version 5.18 is affected.
- Before 5.18 is unaffected.
- Version 6.1.178, <= 6.1.* is unaffected.
- Version 6.6.144, <= 6.6.* is unaffected.
- Version 6.12.95, <= 6.12.* is unaffected.
- Version 6.18.38, <= 6.18.* is unaffected.
- Version 7.1.3, <= 7.1.* is unaffected.
- Version 7.2, <= * is unaffected.