CVE-2026-43434 (GCVE-0-2026-43434)

Vulnerability from cvelistv5 – Published: 2026-05-08 14:22 – Updated: 2026-08-05 12:27
VLAI
Title
rust_binder: check ownership before using vma
Summary
In the Linux kernel, the following vulnerability has been resolved: rust_binder: check ownership before using vma When installing missing pages (or zapping them), Rust Binder will look up the vma in the mm by address, and then call vm_insert_page (or zap_page_range_single). However, if the vma is closed and replaced with a different vma at the same address, this can lead to Rust Binder installing pages into the wrong vma. By installing the page into a writable vma, it becomes possible to write to your own binder pages, which are normally read-only. Although you're not supposed to be able to write to those pages, the intent behind the design of Rust Binder is that even if you get that ability, it should not lead to anything bad. Unfortunately, due to another bug, that is not the case. To fix this, store a pointer in vm_private_data and check that the vma returned by vma_lookup() has the right vm_ops and vm_private_data before trying to use the vma. This should ensure that Rust Binder will refuse to interact with any other VMA. The plan is to introduce more vma abstractions to avoid this unsafe access to vm_ops and vm_private_data, but for now let's start with the simplest possible fix. C Binder performs the same check in a slightly different way: it provides a vm_ops->close that sets a boolean to true, then checks that boolean after calling vma_lookup(), but this is more fragile than the solution in this patch. (We probably still want to do both, but the vm_ops->close callback will be added later as part of the follow-up vma API changes.) It's still possible to remap the vma so that pages appear in the right vma, but at the wrong offset, but this is a separate issue and will be fixed when Rust Binder gets a vm_ops->close callback.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: eafedbc7c050c44744fbdf80bdf3315e860b7513 , < 20a01f20d1f4064d90a8627aa41b5987f0220bb9 (git)
Affected: eafedbc7c050c44744fbdf80bdf3315e860b7513 , < 5a472d04fb4b9115fb7d1535bd885cea450f14db (git)
Affected: eafedbc7c050c44744fbdf80bdf3315e860b7513 , < 8ef2c15aeae07647f530d30f6daaf79eb801bcd1 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.18
Unaffected: 0 , < 6.18 (semver)
Unaffected: 6.18.19 , ≤ 6.18.* (semver)
Unaffected: 6.19.9 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/android/binder/page_range.rs"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "20a01f20d1f4064d90a8627aa41b5987f0220bb9",
              "status": "affected",
              "version": "eafedbc7c050c44744fbdf80bdf3315e860b7513",
              "versionType": "git"
            },
            {
              "lessThan": "5a472d04fb4b9115fb7d1535bd885cea450f14db",
              "status": "affected",
              "version": "eafedbc7c050c44744fbdf80bdf3315e860b7513",
              "versionType": "git"
            },
            {
              "lessThan": "8ef2c15aeae07647f530d30f6daaf79eb801bcd1",
              "status": "affected",
              "version": "eafedbc7c050c44744fbdf80bdf3315e860b7513",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/android/binder/page_range.rs"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "lessThan": "6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.19",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.9",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrust_binder: check ownership before using vma\n\nWhen installing missing pages (or zapping them), Rust Binder will look\nup the vma in the mm by address, and then call vm_insert_page (or\nzap_page_range_single). However, if the vma is closed and replaced with\na different vma at the same address, this can lead to Rust Binder\ninstalling pages into the wrong vma.\n\nBy installing the page into a writable vma, it becomes possible to write\nto your own binder pages, which are normally read-only. Although you\u0027re\nnot supposed to be able to write to those pages, the intent behind the\ndesign of Rust Binder is that even if you get that ability, it should not\nlead to anything bad. Unfortunately, due to another bug, that is not the\ncase.\n\nTo fix this, store a pointer in vm_private_data and check that the vma\nreturned by vma_lookup() has the right vm_ops and vm_private_data before\ntrying to use the vma. This should ensure that Rust Binder will refuse\nto interact with any other VMA. The plan is to introduce more vma\nabstractions to avoid this unsafe access to vm_ops and vm_private_data,\nbut for now let\u0027s start with the simplest possible fix.\n\nC Binder performs the same check in a slightly different way: it\nprovides a vm_ops-\u003eclose that sets a boolean to true, then checks that\nboolean after calling vma_lookup(), but this is more fragile\nthan the solution in this patch. (We probably still want to do both, but\nthe vm_ops-\u003eclose callback will be added later as part of the follow-up\nvma API changes.)\n\nIt\u0027s still possible to remap the vma so that pages appear in the right\nvma, but at the wrong offset, but this is a separate issue and will be\nfixed when Rust Binder gets a vm_ops-\u003eclose callback."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached through local Binder device operations: mmap creates the Binder buffer VMA, and BINDER_WRITE_READ transaction ioctls cause Rust Binder to allocate/insert pages into that process\u0027s mm. It is not reachable by network packets or adjacent/physical media.\nAC:L - The attacker controls the relevant VMA lifetime by unmapping and replacing their Binder mapping at the same address, then triggering Binder page installation or shrinker zapping. This is attacker-controlled state rather than an uncontrollable race, so complexity is low.\nPR:L - A basic local user or Android app with access to a Rust Binder device can reach the ioctl/mmap path, and binderfs is user-namespace mountable in plausible deployments. No real init-namespace root capability is required for the highest reasonable local scenario.\nUI:N - Exploitation does not require a victim user to open a file, mount anything, or otherwise interact manually. The attacker can drive the Binder device operations programmatically.\nS:U - The bug is in the kernel Binder driver and impacts resources mediated by the same kernel security authority. This is a local kernel/Binder privilege or isolation break rather than a VM escape or separate-security-authority compromise.\nC:H - Installing Binder pages into an attacker-writable VMA lets the attacker modify Binder buffers that the kernel assumes are read-only, enabling confused transaction parsing and possible access to privileged sender resources. Given the documented privilege-escalation consequence and uncertainty rule, confidentiality is high.\nI:H - The attacker can corrupt live Binder transaction buffer contents and exploit the companion offset-read behavior to make the kernel misinterpret sender-supplied objects, plausibly escalating privileges or altering security-relevant IPC state. This is a high integrity impact.\nA:H - The same wrong-VMA page insertion/zapping and writable Binder buffer corruption can destabilize Binder state and can plausibly produce kernel oopses or repeated denial of service during failed exploitation. Under the required higher-severity rule, availability is high."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:27:54.685Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/20a01f20d1f4064d90a8627aa41b5987f0220bb9"
        },
        {
          "url": "https://git.kernel.org/stable/c/5a472d04fb4b9115fb7d1535bd885cea450f14db"
        },
        {
          "url": "https://git.kernel.org/stable/c/8ef2c15aeae07647f530d30f6daaf79eb801bcd1"
        }
      ],
      "title": "rust_binder: check ownership before using vma",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43434",
    "datePublished": "2026-05-08T14:22:05.269Z",
    "dateReserved": "2026-05-01T14:12:56.009Z",
    "dateUpdated": "2026-08-05T12:27:54.685Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-43434",
      "date": "2026-08-19",
      "epss": "0.00128",
      "percentile": "0.02854"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-43434\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-08T15:16:55.713\",\"lastModified\":\"2026-06-17T10:49:35.607\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nrust_binder: check ownership before using vma\\n\\nWhen installing missing pages (or zapping them), Rust Binder will look\\nup the vma in the mm by address, and then call vm_insert_page (or\\nzap_page_range_single). However, if the vma is closed and replaced with\\na different vma at the same address, this can lead to Rust Binder\\ninstalling pages into the wrong vma.\\n\\nBy installing the page into a writable vma, it becomes possible to write\\nto your own binder pages, which are normally read-only. Although you\u0027re\\nnot supposed to be able to write to those pages, the intent behind the\\ndesign of Rust Binder is that even if you get that ability, it should not\\nlead to anything bad. Unfortunately, due to another bug, that is not the\\ncase.\\n\\nTo fix this, store a pointer in vm_private_data and check that the vma\\nreturned by vma_lookup() has the right vm_ops and vm_private_data before\\ntrying to use the vma. This should ensure that Rust Binder will refuse\\nto interact with any other VMA. The plan is to introduce more vma\\nabstractions to avoid this unsafe access to vm_ops and vm_private_data,\\nbut for now let\u0027s start with the simplest possible fix.\\n\\nC Binder performs the same check in a slightly different way: it\\nprovides a vm_ops-\u003eclose that sets a boolean to true, then checks that\\nboolean after calling vma_lookup(), but this is more fragile\\nthan the solution in this patch. (We probably still want to do both, but\\nthe vm_ops-\u003eclose callback will be added later as part of the follow-up\\nvma API changes.)\\n\\nIt\u0027s still possible to remap the vma so that pages appear in the right\\nvma, but at the wrong offset, but this is a separate issue and will be\\nfixed when Rust Binder gets a vm_ops-\u003eclose callback.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/android/binder/page_range.rs\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"eafedbc7c050c44744fbdf80bdf3315e860b7513\",\"lessThan\":\"20a01f20d1f4064d90a8627aa41b5987f0220bb9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"eafedbc7c050c44744fbdf80bdf3315e860b7513\",\"lessThan\":\"5a472d04fb4b9115fb7d1535bd885cea450f14db\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"eafedbc7c050c44744fbdf80bdf3315e860b7513\",\"lessThan\":\"8ef2c15aeae07647f530d30f6daaf79eb801bcd1\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/android/binder/page_range.rs\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.19\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.9\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.18\",\"versionEndExcluding\":\"6.18.19\",\"matchCriteriaId\":\"4B3A7D3C-8D62-43DB-ADD2-83F0634E4C23\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.9\",\"matchCriteriaId\":\"E825E7C3-FEAC-4FD3-8A81-78D7387948C9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"F253B622-8837-4245-BCE5-A7BF8FC76A16\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F666C8D8-6538-46D4-B318-87610DE64C34\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/20a01f20d1f4064d90a8627aa41b5987f0220bb9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5a472d04fb4b9115fb7d1535bd885cea450f14db\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8ef2c15aeae07647f530d30f6daaf79eb801bcd1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-28T11:51:55+00:00",
      "cve": "CVE-2026-43434",
      "id": "CVE-2026-43434",
      "initial_release_date": "2026-05-08T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: rust_binder: check ownership before using vma",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43434.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.