Executive brief
A vulnerability exists in the Linux kernel's Rust implementation of the Binder driver, which is a system used for communication between different processes, primarily on Android. An attacker could potentially exploit a timing issue to modify data while the kernel is processing it, which could lead to a local user gaining higher privileges on the system. This could allow an unauthorized user to access sensitive data or take control of other processes.
Technical details
A Time-of-Check Time-of-Use (TOCTOU) vulnerability exists in the rust_binder component of the Linux kernel. When processing a transaction, the kernel copies an offsets array into the target process's Virtual Memory Area (VMA) and subsequently reads it back. Although the VMA is intended to be read-only, if a target process can write to its own VMA (potentially through another bug), it can modify the offsets between the write and the subsequent read. This causes the kernel to misinterpret the transaction payload, potentially allowing the receiver to escalate privileges into the sender's context. The fix involves removing the redundant read from the user-controlled VMA and using the original values.
Affected products
- Linux Linux Kernel 6.18 to 6.18.19, 6.19 to 6.19.9, 7.0-rc1 to 7.0-rc3
Timeline
- 2026-02-18: other: Patch authored
- 2026-05-08: disclosed: CVE published
- 2026-05-22: advisory: NVD analysis completed