CVE-2025-71274
Race Condition in Linux Kernel RPMSG Driver Override
Publication date: 2026-05-06
Last updated on: 2026-05-06
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
The vulnerability has been fixed by updating the Linux kernel to a version where the race condition in the driver_override_show function is resolved.
To mitigate this vulnerability, you should update your Linux kernel to the fixed version that includes the patch replacing the rpmsg_string_attr macro with explicit show and store functions, ensuring proper locking with device_lock.
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's rpmsg core, specifically in the driver_override_show() function. The issue is a race condition caused because driver_override_show() reads a string without holding the device_lock, while the corresponding store function modifies and frees that string while holding the device_lock. This can lead to a use-after-free scenario where the string is freed during the read operation, potentially causing undefined behavior or crashes.
The fix involved replacing the rpmsg_string_attr macro with explicit show and store functions. The new driver_override_show() function now holds the device_lock during the read to prevent the race, and the store function uses the standard driver_set_override helper, which properly manages the locking and string modifications.
How can this vulnerability impact me? :
This vulnerability can lead to a use-after-free condition in the Linux kernel, which may cause system instability, crashes, or potentially allow an attacker to execute arbitrary code or escalate privileges if exploited. The race condition in handling the driver_override string could be triggered under certain conditions, impacting the reliability and security of the affected system.