Executive brief
A vulnerability in the Linux kernel's Rust-based Binder driver could allow a local user to cause a memory leak. This occurs when a process fails to properly clean up certain listeners before closing connections, potentially leading to system resource exhaustion over time. While it does not directly expose data, it can impact the long-term stability and performance of the operating system.
Technical details
A vulnerability in the rust_binder driver of the Linux kernel arises from a failure to clear freeze listeners when a node is removed. While userspace is expected to explicitly clear these listeners before dropping the refcount to zero, the kernel does not enforce this behavior. Consequently, freeze listeners can remain in the freeze_listeners rbtree and the remote node's list even after the associated reference is gone, creating a refcount cycle that leads to a memory leak. This issue was addressed by ensuring freeze listeners are removed during node cleanup. The fix affects drivers/android/binder/freeze.rs, node.rs, and process.rs.
Affected products
- Linux Linux Kernel 6.18 to 6.18.39, 7.1 to 7.1.4, 7.2-rc3
Timeline
- 2026-07-25: advisory: NVD publication date
- 2026-07-03: patched: Initial fix commit by Alice Ryhl