CVE-2026-63797

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63797", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.012Z", "datePublished": "2026-07-19T12:02:05.227Z", "dateUpdated": "2026-08-17T04:51:02.287Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T04:51:02.287Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrpmsg: char: Fix use-after-free on probe error path\n\nrpmsg_chrdev_probe() stores the newly allocated eptdev in the default\nendpoint's priv pointer before calling rpmsg_chrdev_eptdev_add(). If\nrpmsg_chrdev_eptdev_add() then fails, its error path frees eptdev while\nthe default endpoint may still dispatch callbacks with the stale priv\npointer.\n\nAvoid publishing eptdev through the default endpoint until\nrpmsg_chrdev_eptdev_add() succeeds. Messages received before the priv\npointer is published should be ignored by rpmsg_ept_cb(). Flow-control\nupdates can hit rpmsg_ept_flow_cb() in the same window, so make both\ncallbacks return success when priv is NULL."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is in the rpmsg char driver and is reached when a coprocessor sends IPC messages over virtio/glink/SMD after announcing an rpmsg-raw channel; this is on-chip inter-processor communication, not a network-facing kernel protocol.\nAC:L - A compromised or malicious remote processor controls both channel announcements (to force probe failure via minor exhaustion) and the timing of inbound messages that invoke the stale priv pointer, making the race reliably attacker-driven.\nPR:N - Exploitation requires no Linux credentials; a compromised remote processor (modem, DSP, Cortex-M firmware) can announce rpmsg-raw channels and send messages without any local user or root access on the AP.\nUI:N - No victim user action is required; the remote processor initiates channel creation and message delivery autonomously through the rpmsg name service and messaging bus.\nS:U - The UAF corrupts kernel heap memory on the application processor, enabling privilege escalation within the kernel security boundary rather than crossing a VM or IOMMU isolation boundary.\nC:H - The use-after-free dereferences a freed kmalloc object to access queue_lock, skb queue heads, and wait queues, providing attacker-influenced heap reads that can be leveraged for arbitrary kernel memory disclosure.\nI:H - The UAF writes to fields in the freed rpmsg_eptdev structure (spinlock, skb queue, flow-control flags, wait queue), enabling heap corruption primitives that can be developed into arbitrary kernel writes or code execution.\nA:H - Use-after-free access to freed eptdev memory can cause kernel oops/panic from corrupting spinlocks and wait queues, and repeated triggering by the remote processor enables sustained denial of service."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/rpmsg/rpmsg_char.c"], "versions": [{"version": "bc69d10665690492421d926b1cd9a7a36bffd691", "lessThan": "1306fc4f76f765727a6d5aefbf08ef0c8f32996f", "status": "affected", "versionType": "git"}, {"version": "bc69d10665690492421d926b1cd9a7a36bffd691", "lessThan": "ddf13f91ca82c94ef7ad9c41a434a03313f8eb1b", "status": "affected", "versionType": "git"}, {"version": "bc69d10665690492421d926b1cd9a7a36bffd691", "lessThan": "c5ebb06c7e24d531b68707168e04698859d642bc", "status": "affected", "versionType": "git"}, {"version": "bc69d10665690492421d926b1cd9a7a36bffd691", "lessThan": "104d100212396801f1d9d388282f746e23e2bfd6", "status": "affected", "versionType": "git"}, {"version": "bc69d10665690492421d926b1cd9a7a36bffd691", "lessThan": "ff268cd9ccbce6472a0658791b417bf11c31ee39", "status": "affected", "versionType": "git"}, {"version": "bc69d10665690492421d926b1cd9a7a36bffd691", "lessThan": "1ff3f528e67d20e2b1483dcaba899dc7832b2e6b", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/rpmsg/rpmsg_char.c"], "versions": [{"version": "5.18", "status": "affected"}, {"version": "0", "lessThan": "5.18", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.178", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.144", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.95", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.38", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.3", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.1.178"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.6.144"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.12.95"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.18.38"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "7.1.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/1306fc4f76f765727a6d5aefbf08ef0c8f32996f"}, {"url": "https://git.kernel.org/stable/c/ddf13f91ca82c94ef7ad9c41a434a03313f8eb1b"}, {"url": "https://git.kernel.org/stable/c/c5ebb06c7e24d531b68707168e04698859d642bc"}, {"url": "https://git.kernel.org/stable/c/104d100212396801f1d9d388282f746e23e2bfd6"}, {"url": "https://git.kernel.org/stable/c/ff268cd9ccbce6472a0658791b417bf11c31ee39"}, {"url": "https://git.kernel.org/stable/c/1ff3f528e67d20e2b1483dcaba899dc7832b2e6b"}], "title": "rpmsg: char: Fix use-after-free on probe error path", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/rpmsg/rpmsg_char.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "1306fc4f76f765727a6d5aefbf08ef0c8f32996f", "status": "affected", "version": "bc69d10665690492421d926b1cd9a7a36bffd691", "versionType": "git"}, {"lessThan": "ddf13f91ca82c94ef7ad9c41a434a03313f8eb1b", "status": "affected", "version": "bc69d10665690492421d926b1cd9a7a36bffd691", "versionType": "git"}, {"lessThan": "c5ebb06c7e24d531b68707168e04698859d642bc", "status": "affected", "version": "bc69d10665690492421d926b1cd9a7a36bffd691", "versionType": "git"}, {"lessThan": "104d100212396801f1d9d388282f746e23e2bfd6", "status": "affected", "version": "bc69d10665690492421d926b1cd9a7a36bffd691", "versionType": "git"}, {"lessThan": "ff268cd9ccbce6472a0658791b417bf11c31ee39", "status": "affected", "version": "bc69d10665690492421d926b1cd9a7a36bffd691", "versionType": "git"}, {"lessThan": "1ff3f528e67d20e2b1483dcaba899dc7832b2e6b", "status": "affected", "version": "bc69d10665690492421d926b1cd9a7a36bffd691", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/rpmsg/rpmsg_char.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.18"}, {"lessThan": "5.18", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.178", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.144", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.95", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.38", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "43044073-5742-448F-B568-FA7A8A39ABDF", "versionEndExcluding": "6.1.178", "versionStartIncluding": "5.18", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C8AD3BC8-C843-423C-B9DB-CB52F67F578E", "versionEndExcluding": "6.6.144", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4E206B86-E0E3-4394-A93F-39F2D50A8AA8", "versionEndExcluding": "6.12.95", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "FA591B28-5D62-449E-BDBE-3C9391BF070A", "versionEndExcluding": "6.18.38", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9526B150-E2B3-4C6F-8AE5-1AF92B75AD9E", "versionEndExcluding": "7.1.3", "versionStartIncluding": "6.19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrpmsg: char: Fix use-after-free on probe error path\n\nrpmsg_chrdev_probe() stores the newly allocated eptdev in the default\nendpoint's priv pointer before calling rpmsg_chrdev_eptdev_add(). If\nrpmsg_chrdev_eptdev_add() then fails, its error path frees eptdev while\nthe default endpoint may still dispatch callbacks with the stale priv\npointer.\n\nAvoid publishing eptdev through the default endpoint until\nrpmsg_chrdev_eptdev_add() succeeds. Messages received before the priv\npointer is published should be ignored by rpmsg_ept_cb(). Flow-control\nupdates can hit rpmsg_ept_flow_cb() in the same window, so make both\ncallbacks return success when priv is NULL."}], "id": "CVE-2026-63797", "lastModified": "2026-08-17T05:17:15.980", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-07-19T12:16:52.190", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/104d100212396801f1d9d388282f746e23e2bfd6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1306fc4f76f765727a6d5aefbf08ef0c8f32996f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1ff3f528e67d20e2b1483dcaba899dc7832b2e6b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c5ebb06c7e24d531b68707168e04698859d642bc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ddf13f91ca82c94ef7ad9c41a434a03313f8eb1b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ff268cd9ccbce6472a0658791b417bf11c31ee39"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: rpmsg: char: Fix use-after-free on probe error path", "id": "2502226", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502226"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nrpmsg: char: Fix use-after-free on probe error path\nrpmsg_chrdev_probe() stores the newly allocated eptdev in the default\nendpoint's priv pointer before calling rpmsg_chrdev_eptdev_add(). If\nrpmsg_chrdev_eptdev_add() then fails, its error path frees eptdev while\nthe default endpoint may still dispatch callbacks with the stale priv\npointer.\nAvoid publishing eptdev through the default endpoint until\nrpmsg_chrdev_eptdev_add() succeeds. Messages received before the priv\npointer is published should be ignored by rpmsg_ept_cb(). Flow-control\nupdates can hit rpmsg_ept_flow_cb() in the same window, so make both\ncallbacks return success when priv is NULL.", "A flaw was found in the Linux kernel's rpmsg character device. This vulnerability, a use-after-free, occurs during the probe process when an internal pointer to a device endpoint (eptdev) is prematurely stored. If an error occurs during the device's addition, the eptdev memory is freed, but the system may still attempt to access this freed memory. This could lead to system instability or potentially allow an attacker to execute arbitrary code."], "name": "CVE-2026-63797", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-63797\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-63797\nhttps://lore.kernel.org/linux-cve-announce/2026071900-CVE-2026-63797-44ec@gregkh/T"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bc69d10665690492421d926b1cd9a7a36bffd691,ddf13f91ca82c94ef7ad9c41a434a03313f8eb1b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bc69d10665690492421d926b1cd9a7a36bffd691,c5ebb06c7e24d531b68707168e04698859d642bc)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bc69d10665690492421d926b1cd9a7a36bffd691,104d100212396801f1d9d388282f746e23e2bfd6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bc69d10665690492421d926b1cd9a7a36bffd691,ff268cd9ccbce6472a0658791b417bf11c31ee39)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bc69d10665690492421d926b1cd9a7a36bffd691,1ff3f528e67d20e2b1483dcaba899dc7832b2e6b)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.18"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.18)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.144,7.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.95,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.38,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.3,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc1,*)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-21T01:45:05.059644+00:00", "updated": "2026-08-12T12:15:04.902176+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-416"]}