CVE-2026-63797: rpmsg: char: Fix use-after-free on probe error path
High 8.4 EPSS 0.1% Linux kernel
In the Linux kernel, the following vulnerability has been resolved: rpmsg: char: Fix use-after-free on probe error path rpmsg_chrdev_probe() stores the newly allocated eptdev in the default endpoint's priv pointer before calling rpmsg_chrdev_eptdev_add(). If rpmsg_chrdev_eptdev_add() then fails, its error path frees eptdev while the default endpoint may still dispatch callbacks with the stale priv pointer. Avoid publishing eptdev through the default endpoint until rpmsg_chrdev_eptdev_add() succeeds. Messages received before the priv pointer is published should be ignored by rpmsg_ept_cb(). Flow-control updates can hit rpmsg_ept_flow_cb() in the same window, so make both callbacks return success when priv is NULL.
- CVE-2026-63797CVE identifier
- 8.4CVSS 3.1 base score (high)
- 0.1%EPSS: chance of exploitation in the next 30 days (higher than 4% of CVEs)
- 2026-07-19published
What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms
What to do now
- Check whether you run Linux kernel and which version (commands below).
- Install the fixed version for your system: see “Patch it” below.
- Reboot into the new kernel (uname -r to confirm); live patching (kpatch, Ubuntu Livepatch, SUSE kGraft/klp) can defer the reboot for some CVEs
Affected and fixed versions
Affected:
- Linux Linux bc69d10665690492421d926b1cd9a7a36bffd691 to before 1306fc4f76f765727a6d5aefbf08ef0c8f32996f
- Linux Linux bc69d10665690492421d926b1cd9a7a36bffd691 to before ddf13f91ca82c94ef7ad9c41a434a03313f8eb1b
- Linux Linux bc69d10665690492421d926b1cd9a7a36bffd691 to before c5ebb06c7e24d531b68707168e04698859d642bc
- Linux Linux bc69d10665690492421d926b1cd9a7a36bffd691 to before 104d100212396801f1d9d388282f746e23e2bfd6
- Linux Linux bc69d10665690492421d926b1cd9a7a36bffd691 to before ff268cd9ccbce6472a0658791b417bf11c31ee39
- Linux Linux bc69d10665690492421d926b1cd9a7a36bffd691 to before 1ff3f528e67d20e2b1483dcaba899dc7832b2e6b
- Linux Linux 5.18
Patch it
Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.
Debian
sudo apt update
sudo apt install --only-upgrade linux-image-amd64Ubuntu
sudo apt update
sudo apt install --only-upgrade linux-image-generic (or the installed flavour: linux-image-aws, -azure, -gcp, -virtual)RHEL, AlmaLinux, Rocky, Oracle
sudo dnf upgrade --refresh kernelFedora
sudo dnf upgrade --refresh kernelSUSE / openSUSE
sudo zypper refresh
sudo zypper update kernel-defaultAmazon Linux
sudo dnf upgrade --releasever=latest kernel kernel6.12Arch Linux
sudo pacman -SyuAlpine
apk update && apk upgrade linux-lts linux-virtFreeBSD
not LinuxGeneral update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.
Fix status in Linux distributions
| Release | Package | Status | Fixed version / advisory |
|---|---|---|---|
| Debian 12 | linux | fixed | 6.1.180-1 |
| Debian 13 | linux | fixed | 6.12.95-1 |
| Debian testing | linux | fixed | 7.1.3-1 |
| Red Hat Enterprise Linux 10 | kernel | affected | |
From the Debian security tracker, Ubuntu CVE tracker and Red Hat Security Data API, refreshed every few hours.
Sources
- https://git.kernel.org/stable/c/1306fc4f76f765727a6d5aefbf08ef0c8f32996f
- https://git.kernel.org/stable/c/ddf13f91ca82c94ef7ad9c41a434a03313f8eb1b
- https://git.kernel.org/stable/c/c5ebb06c7e24d531b68707168e04698859d642bc
- https://git.kernel.org/stable/c/104d100212396801f1d9d388282f746e23e2bfd6
- https://git.kernel.org/stable/c/ff268cd9ccbce6472a0658791b417bf11c31ee39
- https://git.kernel.org/stable/c/1ff3f528e67d20e2b1483dcaba899dc7832b2e6b
- CVE-2026-63797 on CVE.org
- CVE-2026-63797 on NVD
Page generated automatically from official sources on 2026-11-03 18:05 UTC. Always confirm with your vendor's advisory.