CVE-2026-63797: rpmsg: char: Fix use-after-free on probe error path
In the Linux kernel, the following vulnerability has been resolved:
rpmsg: char: Fix use-after-free on probe error path
rpmsgchrdevprobe() stores the newly allocated eptdev in the default endpoint's priv pointer before calling rpmsgchrdeveptdevadd(). If rpmsgchrdeveptdevadd() then fails, its error path frees eptdev while the default endpoint may still dispatch callbacks with the stale priv pointer.
Avoid publishing eptdev through the default endpoint until rpmsgchrdeveptdevadd() succeeds. Messages received before the priv pointer is published should be ignored by rpmsgeptcb(). Flow-control updates can hit rpmsgeptflowcb() in the same window, so make both callbacks return success when priv is NULL.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Do not publish eptdev via the default endpoint until the fix is applied; otherwise rpmsg_ept_cb() / rpmsg_ept_flow_cb() may dispatch callbacks using a stale priv pointer.
rpmsg (rpmsg char device eptdev/default endpoint publishing) default endpoint publishing of eptdev = disabled until fix is applied - Compensating control
Avoid publishing eptdev through the default endpoint until the rpmsg use-after-free issue is resolved (so callbacks with a stale priv pointer are not dispatched in the probe error window).
Event History
Frequently Asked Questions
What conditions are required for the use-after-free to occur?
Systems using the Linux kernel rpmsg character-device probe path are exposed when rpmsg_chrdev_eptdev_add() fails after the newly allocated endpoint device has been stored in the default endpoint's priv pointer. The issue is local according to the supplied CVSS vector (AV:L), with no privileges or user interaction required by that vector.
Why can callbacks trigger the issue after endpoint-device creation fails?
The vulnerable window exists only on the probe error path: endpoint-device creation must fail after the object has been published through the default endpoint's priv pointer. A subsequently received message or flow-control update can invoke a callback using that stale pointer.
What behavior changes with the fix?
The fix delays publication of the endpoint device in the default endpoint's priv pointer until rpmsg_chrdev_eptdev_add() succeeds. It also makes both message and flow-control callbacks return success when priv is NULL, causing events received before publication to be ignored.