{"id":"CVE-2025-71274","revision":"79998c3dcbfe4aceaeb2aad00c2ac683","records":[{"revision":"79998c3dcbfe4aceaeb2aad00c2ac683","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-71274","aliases":[],"title":"rpmsg: core: fix race in driver_override_show() and use core helper","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nrpmsg: core: fix race in driver_override_show() and use core helper\n\nThe driver_override_show function reads the driver_override string\nwithout holding the device_lock. However, the store function modifies\nand frees the string while holding the device_lock. This creates a race\ncondition where the string can be freed by the store function while\nbeing read by the show function, leading to a use-after-free.\n\nTo fix this, replace the rpmsg_string_attr macro with explicit show and\nstore functions. The new driver_override_store uses the standard\ndriver_set_override helper. Since the introduction of\ndriver_set_override, the comments in include/linux/rpmsg.h have stated\nthat this helper must be used to set or clear driver_override, but the\nimplementation was not updated until now.\n\nBecause driver_set_override modifies and frees the string while holding\nthe device_lock, the new driver_override_show now correctly holds the\ndevice_lock during the read operation to prevent the race.\n\nAdditionally, since rpmsg_string_attr has only ever been used for\ndriver_override, removing the macro simplifies the code.","state":0,"publishedAt":"2026-05-06T11:27:07.525+00:00","modifiedAt":"2026-10-19T18:25:25.313+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/rpmsg/rpmsg_core.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"39e47767ec9b22f844c2a07c9d329256960d4021\",\n                            \"lessThan\": \"392c6b68334aa0e0ae9aba95c0a366bcb0d92f5d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"39e47767ec9b22f844c2a07c9d329256960d4021\",\n                            \"lessThan\": \"d66b8074c555e8abb0ae19eea1c9f3635498bdde\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"39e47767ec9b22f844c2a07c9d329256960d4021\",\n                            \"lessThan\": \"47615557447185917afa432b7958f87583c417cb\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"39e47767ec9b22f844c2a07c9d329256960d4021\",\n                            \"lessThan\": \"90c8353f471821d7ccd4fe573a2402e056192494\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"39e47767ec9b22f844c2a07c9d329256960d4021\",\n                            \"lessThan\": \"7654e6e3cd6bdee9602f6063b3c670bd556d7e61\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"39e47767ec9b22f844c2a07c9d329256960d4021\",\n                            \"lessThan\": \"2e4a70f3c30910427e5ea848b799066d67b963d5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"39e47767ec9b22f844c2a07c9d329256960d4021\",\n                            \"lessThan\": \"954557957177c3c13d7c655976665b1170da5e50\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"39e47767ec9b22f844c2a07c9d329256960d4021\",\n                            \"lessThan\": \"42023d4b6d2661a40ee2dcf7e1a3528a35c638ca\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/rpmsg/rpmsg_core.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.18\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.18\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.252\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.202\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.165\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.128\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.75\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.16\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.19.6\",\n                            \"lessThanOrEqual\": \"6.19.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.0\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/392c6b68334aa0e0ae9aba95c0a366bcb0d92f5d","https://git.kernel.org/stable/c/d66b8074c555e8abb0ae19eea1c9f3635498bdde","https://git.kernel.org/stable/c/47615557447185917afa432b7958f87583c417cb","https://git.kernel.org/stable/c/90c8353f471821d7ccd4fe573a2402e056192494","https://git.kernel.org/stable/c/7654e6e3cd6bdee9602f6063b3c670bd556d7e61","https://git.kernel.org/stable/c/2e4a70f3c30910427e5ea848b799066d67b963d5","https://git.kernel.org/stable/c/954557957177c3c13d7c655976665b1170da5e50","https://git.kernel.org/stable/c/42023d4b6d2661a40ee2dcf7e1a3528a35c638ca"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-71274","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-71274","identifiers":["CVE-2025-71274"]},"retained":false,"historicalAffected":[]}],"coverage":[]}