CVE-2025-71274 rpmsg: core: fix race in driver_override_show() and use core helper
A race condition in the Linux kernel rpmsg driver allows a use-after-free, potentially enabling local attackers to execute code or escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-71274?
CVE-2025-71274 is a high-severity vulnerability in Linux kernel, published on 6 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
rpmsg: core: fix race in driver_override_show() and use core helper
The driver_override_show function reads the driver_override string without holding the device_lock. However, the store function modifies and frees the string while holding the device_lock. This creates a race condition where the string can be freed by the store function while being read by the show function, leading to a use-after-free.
To fix this, replace the rpmsg_string_attr macro with explicit show and store functions. The new driver_override_store uses the standard driver_set_override helper. Since the introduction of driver_set_override, the comments in include/linux/rpmsg.h have stated that this helper must be used to set or clear driver_override, but the implementation was not updated until now.
Because driver_set_override modifies and frees the string while holding the device_lock, the new driver_override_show now correctly holds the device_lock during the read operation to prevent the race.
Additionally, since rpmsg_string_attr has only ever been used for driver_override, removing the macro simplifies the code.
Weakness: CWE-362
Which versions are affected by CVE-2025-71274?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-71274?
Apply the vendor's patch.
Is CVE-2025-71274 being exploited?
There is no known exploitation of CVE-2025-71274 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2025-71274, DEBIAN-CVE-2025-71274, GHSA-qgf6-m828-gpv5, ROOT-OS-DEBIAN-11-CVE-2025-71274, ROOT-OS-UBUNTU-2204-CVE-2025-71274, ROOT-OS-UBUNTU-2404-CVE-2025-71274 and 1 more.