The Linux kernel rpmsg subsystem contains a race condition between the rpmsg driver_override_show function and its store counterpart. The show routine reads the driver_override string without holding device_lock, while the store routine modifies and frees that string while holding the lock. This mismatch can allow the string to be freed concurrently with a read, leading to a use‑after‑free that may corrupt kernel memory and enable an attacker with local access to execute arbitrary code. The weakness aligns with a race condition (CWE-364) at the kernel level, culminating in memory corruption.

All Linux kernel releases that contain the rpmsg framework prior to the commit that replaces rpmsg_string_attr with a store helper and proper locking are vulnerable. The issue applies across all supported architectures that ship the rpmsg subsystem, and any version lacking the driver_set_override patch is affected.

Although no EPSS score or KEV listing is available, the use‑after‑free in kernel space constitutes a high‑severity flaw. Exploitation would require local or elevated privileges and a path to trigger simultaneous read and write operations on the driver_override sysfs attribute. No publicly known exploits exist as of the latest advisory, but the potential for kernel memory corruption makes it a serious concern.