CVE-2025-71274

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

rpmsg: core: fix race in driver_override_show() and use core helper

The driver_override_show function reads the driver_override string

without holding the device_lock. However, the store function modifies

and frees the string while holding the device_lock. This creates a race

condition where the string can be freed by the store function while

being read by the show function, leading to a use-after-free.

To fix this, replace the rpmsg_string_attr macro with explicit show and

store functions. The new driver_override_store uses the standard

driver_set_override helper. Since the introduction of

driver_set_override, the comments in include/linux/rpmsg.h have stated

that this helper must be used to set or clear driver_override, but the

implementation was not updated until now.

Because driver_set_override modifies and frees the string while holding

the device_lock, the new driver_override_show now correctly holds the

devi

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References