Executive brief
A race condition exists in the Rust implementation of the Android Binder driver within the Linux kernel. This component is responsible for communication between different processes on Android systems. An exploit could allow a local attacker to cause system crashes or potentially gain unauthorized access to sensitive kernel memory, impacting system stability and security.
Technical details
A race condition exists in the rust_binder driver within the Linux kernel due to unsafe list operations on 'death_list'. In Node::release, the code moves items to a local stack list and drops the lock before iteration; however, other threads may concurrently attempt to remove elements from the original list using unsafe pointers. This concurrent access results in a data race on the prev/next pointers, leading to memory corruption and kernel panics (Oops). The vulnerability is triggered locally and requires no user interaction. The fix involves modifying Node::release to pop items directly from the original list while maintaining proper locking.
Affected products
- Linux Linux Kernel 6.18 to 6.18.1
Timeline
- 2025-11-11: other: Patch submitted by developer
- 2025-11-26: patched: Patch committed to stable tree
- 2025-12-16: advisory: NVD advisory published