In the Linux kernel, the following vulnerability has been resolved: rpmsg: char: Fix use-after-free on probe error path rpmsg_chrdev_probe() stores the newly allocated eptdev in the default endpoint's priv pointer before calling rpmsg_chrdev_eptdev_add(). If rpmsg_chrdev_eptdev_add() then fails, its error path frees eptdev while the default endpoint may still dispatch callbacks with the stale priv pointer. Avoid publishing eptdev through the default endpoint until rpmsg_chrdev_eptdev_add() succeeds. Messages received before the priv pointer is published should be ignored by rpmsg_ept_cb(). Flow-control updates can hit rpmsg_ept_flow_cb() in the same window, so make both callbacks return success when priv is NULL.
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-63797 is a use-after-free vulnerability in the Linux kernel's RPMsg character device driver that occurs during the probe error path. The flaw exists in rpmsg_chrdev_probe(), which prematurely stores a newly allocated endpoint device (eptdev) pointer in the default endpoint's private data before validating successful initialization. If rpmsg_chrdev_eptdev_add() subsequently fails, the error handler frees eptdev while the default endpoint may still have active callback mechanisms referencing this freed memory. This vulnerability affects Linux systems utilizing RPMsg IPC (inter-process communication) functionality, particularly embedded and real-time systems relying on the rpmsg framework. An attacker with the ability to trigger probe failures could potentially achieve memory corruption, information disclosure, or denial of service.
While CVE-2026-63797 has no direct MITRE ATT&CK mapping in the current Casky.ai dataset, practitioners using Claude AI with extended reasoning can detect the underlying attack patterns through memory safety analysis and resource lifecycle tracking. The vulnerability follows a classic T1499-adjacent denial of service pattern combined with memory corruption indicators. Security practitioners would observe use-after-free detection patterns during code analysis, stale pointer dereferences in callback chains, and improper error handling flows in device driver initialization sequences. Casky's AI-powered scanning would flag the temporal mismatch between resource allocation and publication, identifying the race condition between endpoint publication and validation—attack patterns typically associated with privilege escalation and code execution techniques once memory is successfully corrupted.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-63797. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation