Executive brief
A vulnerability was found in the Linux kernel's Android Binder driver, which manages communication between different processes on a device. A technical error in how the system handles memory during certain operations could allow a local user to crash the system or potentially gain unauthorized access. This issue has been resolved in recent kernel updates.
Technical details
A double-free vulnerability exists in the dbitmap component of the Linux kernel's Binder driver. When dbitmap_grow() fails to allocate a new bitmap, it frees the existing bitmap but fails to nullify the pointer in the proc->dmap structure. This leads to a second free operation when the process terminates and dbitmap_free() is called again. A local attacker with access to the Binder interface could trigger this condition to cause memory corruption, leading to a denial of service or potential privilege escalation. The fix involves explicitly setting the map pointer to NULL after the initial free.
Affected products
- Linux Linux 6.11, 6.12.52, 6.16.12, 6.17.2
Timeline
- 2025-10-28: advisory: CVE-2025-40028 published