Executive brief
A vulnerability in the Linux kernel's Android Binder driver (specifically the Rust implementation) could allow a local attacker to bypass system protections designed to prevent resource exhaustion. The driver's mechanism for detecting 'spam'—excessive one-way communication requests—was flawed, either failing to account for the most recent request or missing entirely in certain configurations. This could allow a malicious application to flood the system with transactions, potentially leading to a denial-of-service condition where other apps or system services cannot communicate.
Technical details
A vulnerability exists in the rust_binder driver within the Linux kernel's range allocator logic. In the TreeRange implementation, spam detection was performed before the current request was inserted into the tracking tree, causing the calculation to ignore the most recent transaction. Additionally, the ArrayRange implementation lacked the low_oneway_space() detection logic entirely. These flaws allow local processes to exceed intended asynchronous transaction limits without being flagged. An attacker can exploit this to exhaust the Binder process's available asynchronous buffer space, leading to a denial-of-service (DoS) for Binder-based communications. Patches have been released for stable kernel branches to move the detection logic after insertion and implement the missing checks in ArrayRange.
Affected products
- Linux Linux kernel 6.18 to 6.18.19, 6.19 to 6.19.9, 7.0-rc1 to 7.0-rc3
Timeline
- 2026-02-10: other: Patch authored
- 2026-05-08: disclosed: CVE published