CVE-2026-63797

A flaw was found in the Linux kernel's rpmsg character device. This vulnerability, a use-after-free, occurs during the probe process when an internal pointer to a device endpoint (eptdev) is prematurely stored. If an error occurs during the device's addition, the eptdev memory is freed, but the system may still attempt to access this freed memory. This could lead to system instability or potentially allow an attacker to execute arbitrary code.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, prevent the rpmsg_char kernel module from loading if the Remote Processor Messaging (rpmsg) character device functionality is not required. This can be achieved by creating a modprobe configuration file.

For example, to disable the rpmsg_char module: echo "install rpmsg_char /bin/true" > /etc/modprobe.d/disable-rpmsg_char.conf dracut -f -v (to rebuild initramfs) reboot (to apply changes)

Note that preventing this module from loading may impact systems that rely on rpmsg communication. A system reboot is required for the changes to take effect.