CVE-2026-63797
published 2026-07-19CVE-2026-63797: In the Linux kernel, the following vulnerability has been resolved: rpmsg: char: Fix use-after-free on probe error path rpmsg_chrdev_probe() stores the newly…
PriorityP339high8.4CVSS 3.1
AVLACLPRNUINSUCHIHAH
EPSS
0.14%
3.7th percentile
In the Linux kernel, the following vulnerability has been resolved:
rpmsg: char: Fix use-after-free on probe error path
rpmsg_chrdev_probe() stores the newly allocated eptdev in the default
endpoint's priv pointer before calling rpmsg_chrdev_eptdev_add(). If
rpmsg_chrdev_eptdev_add() then fails, its error path frees eptdev while
the default endpoint may still dispatch callbacks with the stale priv
pointer.
Avoid publishing eptdev through the default endpoint until
rpmsg_chrdev_eptdev_add() succeeds. Messages received before the priv
pointer is published should be ignored by rpmsg_ept_cb(). Flow-control
updates can hit rpmsg_ept_flow_cb() in the same window, so make both
callbacks return success when priv is NULL.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= bc69d10665690492421d926b1cd9a7a36bffd691 < 1306fc4f76f765727a6d5aefbf08ef0c8f32996f | 1306fc4f76f765727a6d5aefbf08ef0c8f32996f |
| linux | linux | >= bc69d10665690492421d926b1cd9a7a36bffd691 < ddf13f91ca82c94ef7ad9c41a434a03313f8eb1b | ddf13f91ca82c94ef7ad9c41a434a03313f8eb1b |
| linux | linux | >= bc69d10665690492421d926b1cd9a7a36bffd691 < c5ebb06c7e24d531b68707168e04698859d642bc | c5ebb06c7e24d531b68707168e04698859d642bc |
| linux | linux | >= bc69d10665690492421d926b1cd9a7a36bffd691 < 104d100212396801f1d9d388282f746e23e2bfd6 | 104d100212396801f1d9d388282f746e23e2bfd6 |
| linux | linux | >= bc69d10665690492421d926b1cd9a7a36bffd691 < ff268cd9ccbce6472a0658791b417bf11c31ee39 | ff268cd9ccbce6472a0658791b417bf11c31ee39 |
| linux | linux | >= bc69d10665690492421d926b1cd9a7a36bffd691 < 1ff3f528e67d20e2b1483dcaba899dc7832b2e6b | 1ff3f528e67d20e2b1483dcaba899dc7832b2e6b |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 5.18 < 6.1.178 | 6.1.178 |
| linux | linux_kernel | >= 6.13 < 6.18.38 | 6.18.38 |
| linux | linux_kernel | >= 6.19 < 7.1.3 | 7.1.3 |
| linux | linux_kernel | >= 6.2 < 6.6.144 | 6.6.144 |
| linux | linux_kernel | >= 6.7 < 6.12.95 | 6.12.95 |
CVSS provenance
nvdv3.18.4HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_redhat8.4HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: rpmsg: char: Fix use-after-free on probe error path
vendor_redhat·2026-07-19·CVSS 8.4
CVE-2026-63797 [HIGH] CWE-825 kernel: rpmsg: char: Fix use-after-free on probe error path
kernel: rpmsg: char: Fix use-after-free on probe error path
In the Linux kernel, the following vulnerability has been resolved:
rpmsg: char: Fix use-after-free on probe error path
rpmsg_chrdev_probe() stores the newly allocated eptdev in the default
endpoint's priv pointer before calling rpmsg_chrdev_eptdev_add(). If
rpmsg_chrdev_eptdev_add() then fails, its error path frees eptdev while
the default endpoint may still dispatch callbacks with the stale priv
pointer.
Avoid publishing eptdev through the default endpoint until
rpmsg_chrdev_eptdev_add() succeeds. Messages received before the priv
pointer is published should be ignored by rpmsg_ept_cb(). Flow-control
updates can hit rpmsg_ept_flow_cb() in the same window, so make both
callbacks return success when priv is NULL.
A flaw was foun
GHSA
In the Linux kernel, the following vulnerability has been resolved: rpmsg: char: Fix use-after-free on probe error path rpmsg_chrdev_probe() stores the newly allocated eptdev in the default endpoint
ghsa_unreviewed·2026-07-19
CVE-2026-63797 [HIGH] In the Linux kernel, the following vulnerability has been resolved: rpmsg: char: Fix use-after-free on probe error path rpmsg_chrdev_probe() stores the newly allocated eptdev in the default endpoint
In the Linux kernel, the following vulnerability has been resolved:
rpmsg: char: Fix use-after-free on probe error path
rpmsg_chrdev_probe() stores the newly allocated eptdev in the default
endpoint's priv pointer before calling rpmsg_chrdev_eptdev_add(). If
rpmsg_chrdev_eptdev_add() then fails, its error path frees eptdev while
the default endpoint may still dispatch callbacks with the stale priv
pointer.
Avoid publishing eptdev through the default endpoint until
rpmsg_chrdev_eptdev_add() succeeds. Messages received before the priv
pointer is published should be ignored by rpmsg_ept_cb(). Flow-control
updates can hit rpmsg_ept_flow_cb() in the same window, so make both
callbacks return success when priv is NULL.
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/104d100212396801f1d9d388282f746e23e2bfd6https://git.kernel.org/stable/c/1306fc4f76f765727a6d5aefbf08ef0c8f32996fhttps://git.kernel.org/stable/c/1ff3f528e67d20e2b1483dcaba899dc7832b2e6bhttps://git.kernel.org/stable/c/c5ebb06c7e24d531b68707168e04698859d642bchttps://git.kernel.org/stable/c/ddf13f91ca82c94ef7ad9c41a434a03313f8eb1bhttps://git.kernel.org/stable/c/ff268cd9ccbce6472a0658791b417bf11c31ee39
2026-07-19
Published