{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-43433", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:56.009Z", "datePublished": "2026-05-08T14:22:04.632Z", "dateUpdated": "2026-08-05T12:27:53.626Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:27:53.626Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrust_binder: avoid reading the written value in offsets array\n\nWhen sending a transaction, its offsets array is first copied into the\ntarget proc's vma, and then the values are read back from there. This is\nnormally fine because the vma is a read-only mapping, so the target\nprocess cannot change the value under us.\n\nHowever, if the target process somehow gains the ability to write to its\nown vma, it could change the offset before it's read back, causing the\nkernel to misinterpret what the sender meant. If the sender happens to\nsend a payload with a specific shape, this could in the worst case lead\nto the receiver being able to privilege escalate into the sender.\n\nThe intent is that gaining the ability to change the read-only vma of\nyour own process should not be exploitable, so remove this TOCTOU read\neven though it's unexploitable without another Binder bug." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - Reachability is through the local Binder character device via mmap and BINDER_WRITE_READ ioctls carrying BC_TRANSACTION/BC_REPLY commands. There is no network or adjacent protocol path.\nAC:L - The vulnerable transaction parsing is deterministic once the target process can write its Binder VMA, and the related same-subsystem VMA ownership bug gives an unprivileged target a plausible way to create that condition. The attacker controls the receiving process, its mapping behavior, and repeated transaction attempts.\nPR:L - An attacker needs local unprivileged access to a Binder device and normal Binder IPC participation, not init-namespace root or a privileged capability. Ordinary Android-style app processes are a reasonable deployment scenario for this subsystem.\nUI:N - No victim user action is required after the attacker process runs; the attacker can drive Binder ioctls and arrange IPC with a target service programmatically.\nS:U - The impact is mediated by the kernel Binder driver within the same OS security authority. This is a local privilege/capability escalation scenario, not a VM escape or other scope boundary crossing.\nC:H - By changing offsets after the kernel copies them into the receiver VMA, a malicious receiver can cause the kernel to reinterpret sender-controlled bytes as Binder objects and obtain privileged handles or file descriptors. In a plausible Android service scenario this can expose highly sensitive resources belonging to a privileged sender.\nI:H - The same confused-object translation can grant the receiver unauthorized Binder capabilities or files from a more privileged sender, enabling high-integrity actions as that sender. The fix commit explicitly describes worst-case privilege escalation into the sender.\nA:H - With privileged Binder capabilities or file descriptors obtained from a high-value sender, the attacker can plausibly disrupt critical system services or resources. Under the required higher-severity rule, the availability impact is scored High for the most severe reasonable deployment." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/android/binder/thread.rs" ], "versions": [ { "version": "eafedbc7c050c44744fbdf80bdf3315e860b7513", "lessThan": "e19afb53f7723b3bd22224f2b0c7dcfa70bb973f", "status": "affected", "versionType": "git" }, { "version": "eafedbc7c050c44744fbdf80bdf3315e860b7513", "lessThan": "3672141c93b7a0c0132bf5d5021a4b7f1d663aaa", "status": "affected", "versionType": "git" }, { "version": "eafedbc7c050c44744fbdf80bdf3315e860b7513", "lessThan": "4cb9e13fec0de7c942f5f927469beb8e48ddd20f", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/android/binder/thread.rs" ], "versions": [ { "version": "6.18", "status": "affected" }, { "version": "0", "lessThan": "6.18", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.19", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.19.9", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "6.18.19" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "6.19.9" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "7.0" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/e19afb53f7723b3bd22224f2b0c7dcfa70bb973f" }, { "url": "https://git.kernel.org/stable/c/3672141c93b7a0c0132bf5d5021a4b7f1d663aaa" }, { "url": "https://git.kernel.org/stable/c/4cb9e13fec0de7c942f5f927469beb8e48ddd20f" } ], "title": "rust_binder: avoid reading the written value in offsets array", "x_generator": { "engine": "bippy-1.2.0" } } } }