CVE-2026-63797: Linux Kernel Use-After-Free Vulnerability

CVE-2026-63797 Overview

CVE-2026-63797 is a use-after-free vulnerability in the Linux kernel's rpmsg_char driver. The flaw resides in rpmsg_chrdev_probe(), which stores a newly allocated eptdev in the default endpoint's priv pointer before calling rpmsg_chrdev_eptdev_add(). When rpmsg_chrdev_eptdev_add() fails, its error path frees eptdev while the default endpoint may still dispatch callbacks referencing the stale priv pointer. This creates a race window where rpmsg_ept_cb() and rpmsg_ept_flow_cb() can operate on freed memory. The vulnerability is classified as a Use After Free issue [CWE-416] affecting kernel remote processor messaging.

Critical Impact
Local attackers with the ability to trigger the probe error path can achieve kernel memory corruption, leading to potential privilege escalation, information disclosure, or denial of service.

Affected Products

Linux kernel versions containing the rpmsg_char driver prior to the fix commits
Distributions shipping vulnerable stable kernel branches (multiple stable trees patched)
Embedded and IoT systems using remote processor messaging (rpmsg) subsystems

Discovery Timeline

2026-07-19 - CVE-2026-63797 published to NVD
2026-07-24 - Last updated in NVD database

Technical Details for CVE-2026-63797

Vulnerability Analysis

The rpmsg_char driver exposes remote processor messaging endpoints to user space through character devices. During probe, rpmsg_chrdev_probe() allocates an endpoint device structure (eptdev) and assigns it to the default endpoint's priv pointer. This assignment happens before the endpoint is fully registered via rpmsg_chrdev_eptdev_add().

If rpmsg_chrdev_eptdev_add() fails, its cleanup logic frees eptdev. However, the default endpoint remains capable of receiving inbound messages and flow-control updates. Both rpmsg_ept_cb() and rpmsg_ept_flow_cb() dereference the now-dangling priv pointer, resulting in a use-after-free condition inside kernel context.

Root Cause

The root cause is improper ordering between resource publication and resource registration. The driver publishes eptdev through the default endpoint's callback context before completing the setup that would make cleanup safe. This violates the invariant that a resource should only be visible to concurrent contexts once it is fully initialized and its lifecycle is guaranteed.

Attack Vector

Exploitation requires local access to trigger the rpmsg probe path and induce failure in rpmsg_chrdev_eptdev_add(). An attacker who can influence device probing, control error conditions, or send crafted messages to the default endpoint during the narrow window between priv assignment and add failure can trigger callback dispatch against freed memory. Successful exploitation of use-after-free in kernel drivers commonly yields kernel memory corruption suitable for local privilege escalation.

No public proof-of-concept exploit is currently available for CVE-2026-63797, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the upstream fix commits for the exact code paths involved: Linux Kernel Commit ff268cd and Linux Kernel Commit 1ff3f52.

Detection Methods for CVE-2026-63797

Indicators of Compromise

Kernel oops or panic messages referencing rpmsg_ept_cb or rpmsg_ept_flow_cb in dmesg or system logs
KASAN reports indicating use-after-free in the rpmsg_char module
Unexpected process crashes or privilege changes on systems running rpmsg-enabled devices
Repeated probe failures in rpmsg_chrdev_eptdev_add() visible in kernel logs

Detection Strategies

Enable KASAN (Kernel Address Sanitizer) on test kernels to catch use-after-free conditions in the rpmsg subsystem
Audit kernel version and module inventory across Linux fleets to identify unpatched hosts running rpmsg_char
Monitor for kernel crash telemetry with stack frames touching rpmsg_chrdev_probe, rpmsg_ept_cb, or rpmsg_ept_flow_cb

Monitoring Recommendations

Collect and centralize dmesg and /var/log/kern.log output for correlation and alerting on rpmsg-related faults
Track kernel package versions with configuration management tooling to confirm patch deployment
Alert on repeated device probe failures on embedded platforms that expose remote processor endpoints

How to Mitigate CVE-2026-63797

Immediate Actions Required

Apply the upstream kernel patches referenced in the stable tree commits to all affected Linux systems
Prioritize patching on hosts that load the rpmsg_char module, especially embedded and multi-tenant systems
Restrict local access to systems until patches are applied, since the attack vector is local
Verify vendor advisories from your Linux distribution for backported fixes

Patch Information

The vulnerability is resolved across multiple stable kernel branches. The fix delays publishing eptdev through the default endpoint until rpmsg_chrdev_eptdev_add() succeeds, and makes rpmsg_ept_cb() and rpmsg_ept_flow_cb() return success when priv is NULL. Relevant commits include Linux Kernel Commit 104d100, Linux Kernel Commit 1306fc4, Linux Kernel Commit 1ff3f52, Linux Kernel Commit c5ebb06, Linux Kernel Commit ddf13f9, and Linux Kernel Commit ff268cd.

Workarounds

Unload or blacklist the rpmsg_char module on systems where remote processor messaging is not required
Limit CAP_SYS_ADMIN and device access to trusted local users to reduce the ability to induce probe failures
Enforce strict access controls on /dev/rpmsg* character devices where the module remains loaded

bash

# Blacklist the rpmsg_char module if not required
echo "blacklist rpmsg_char" | sudo tee /etc/modprobe.d/blacklist-rpmsg.conf
sudo update-initramfs -u

# Verify kernel version after patching
uname -r