The vulnerability is a use‑after‑free in the Linux kernel rpmsg character device driver. When the probe routine stores a newly allocated eptdev structure in the default endpoint’s private data and then the add operation fails, the freed structure can still be referenced by callbacks that handle incoming messages. This stale pointer can corrupt kernel memory, leading to a crash or providing an avenue for arbitrary code execution on the affected system. The weakness is classified as CWE‑825.

All Linux kernel releases containing the rpmsg character device driver before the patch are affected. No specific kernel versions are enumerated, so any kernel build that includes the rpmsg_chrdev interface and has not been back‑ported with the fix is vulnerable. Linux kernels are the affected vendor and product family.

The CVSS score of 8.4 denotes high severity, while the EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild. The vulnerability is not yet listed in the CISA KEV catalog. The likely attack vector is local; an attacker with elevated or kernel module‑loading privileges can trigger the probe error path or send crafted rpmsg messages to invoke the freed pointer, potentially causing a crash or, in the presence of additional heap corruption, enabling privilege escalation.