CVE-2026-43433 (GCVE-0-2026-43433)

Vulnerability from cvelistv5 – Published: 2026-05-08 14:22 – Updated: 2026-08-05 12:27
VLAI
Title
rust_binder: avoid reading the written value in offsets array
Summary
In the Linux kernel, the following vulnerability has been resolved: rust_binder: avoid reading the written value in offsets array When sending a transaction, its offsets array is first copied into the target proc's vma, and then the values are read back from there. This is normally fine because the vma is a read-only mapping, so the target process cannot change the value under us. However, if the target process somehow gains the ability to write to its own vma, it could change the offset before it's read back, causing the kernel to misinterpret what the sender meant. If the sender happens to send a payload with a specific shape, this could in the worst case lead to the receiver being able to privilege escalate into the sender. The intent is that gaining the ability to change the read-only vma of your own process should not be exploitable, so remove this TOCTOU read even though it's unexploitable without another Binder bug.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: eafedbc7c050c44744fbdf80bdf3315e860b7513 , < e19afb53f7723b3bd22224f2b0c7dcfa70bb973f (git)
Affected: eafedbc7c050c44744fbdf80bdf3315e860b7513 , < 3672141c93b7a0c0132bf5d5021a4b7f1d663aaa (git)
Affected: eafedbc7c050c44744fbdf80bdf3315e860b7513 , < 4cb9e13fec0de7c942f5f927469beb8e48ddd20f (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.18
Unaffected: 0 , < 6.18 (semver)
Unaffected: 6.18.19 , ≤ 6.18.* (semver)
Unaffected: 6.19.9 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/android/binder/thread.rs"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e19afb53f7723b3bd22224f2b0c7dcfa70bb973f",
              "status": "affected",
              "version": "eafedbc7c050c44744fbdf80bdf3315e860b7513",
              "versionType": "git"
            },
            {
              "lessThan": "3672141c93b7a0c0132bf5d5021a4b7f1d663aaa",
              "status": "affected",
              "version": "eafedbc7c050c44744fbdf80bdf3315e860b7513",
              "versionType": "git"
            },
            {
              "lessThan": "4cb9e13fec0de7c942f5f927469beb8e48ddd20f",
              "status": "affected",
              "version": "eafedbc7c050c44744fbdf80bdf3315e860b7513",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/android/binder/thread.rs"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "lessThan": "6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.19",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.9",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrust_binder: avoid reading the written value in offsets array\n\nWhen sending a transaction, its offsets array is first copied into the\ntarget proc\u0027s vma, and then the values are read back from there. This is\nnormally fine because the vma is a read-only mapping, so the target\nprocess cannot change the value under us.\n\nHowever, if the target process somehow gains the ability to write to its\nown vma, it could change the offset before it\u0027s read back, causing the\nkernel to misinterpret what the sender meant. If the sender happens to\nsend a payload with a specific shape, this could in the worst case lead\nto the receiver being able to privilege escalate into the sender.\n\nThe intent is that gaining the ability to change the read-only vma of\nyour own process should not be exploitable, so remove this TOCTOU read\neven though it\u0027s unexploitable without another Binder bug."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Reachability is through the local Binder character device via mmap and BINDER_WRITE_READ ioctls carrying BC_TRANSACTION/BC_REPLY commands. There is no network or adjacent protocol path.\nAC:L - The vulnerable transaction parsing is deterministic once the target process can write its Binder VMA, and the related same-subsystem VMA ownership bug gives an unprivileged target a plausible way to create that condition. The attacker controls the receiving process, its mapping behavior, and repeated transaction attempts.\nPR:L - An attacker needs local unprivileged access to a Binder device and normal Binder IPC participation, not init-namespace root or a privileged capability. Ordinary Android-style app processes are a reasonable deployment scenario for this subsystem.\nUI:N - No victim user action is required after the attacker process runs; the attacker can drive Binder ioctls and arrange IPC with a target service programmatically.\nS:U - The impact is mediated by the kernel Binder driver within the same OS security authority. This is a local privilege/capability escalation scenario, not a VM escape or other scope boundary crossing.\nC:H - By changing offsets after the kernel copies them into the receiver VMA, a malicious receiver can cause the kernel to reinterpret sender-controlled bytes as Binder objects and obtain privileged handles or file descriptors. In a plausible Android service scenario this can expose highly sensitive resources belonging to a privileged sender.\nI:H - The same confused-object translation can grant the receiver unauthorized Binder capabilities or files from a more privileged sender, enabling high-integrity actions as that sender. The fix commit explicitly describes worst-case privilege escalation into the sender.\nA:H - With privileged Binder capabilities or file descriptors obtained from a high-value sender, the attacker can plausibly disrupt critical system services or resources. Under the required higher-severity rule, the availability impact is scored High for the most severe reasonable deployment."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:27:53.626Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e19afb53f7723b3bd22224f2b0c7dcfa70bb973f"
        },
        {
          "url": "https://git.kernel.org/stable/c/3672141c93b7a0c0132bf5d5021a4b7f1d663aaa"
        },
        {
          "url": "https://git.kernel.org/stable/c/4cb9e13fec0de7c942f5f927469beb8e48ddd20f"
        }
      ],
      "title": "rust_binder: avoid reading the written value in offsets array",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43433",
    "datePublished": "2026-05-08T14:22:04.632Z",
    "dateReserved": "2026-05-01T14:12:56.009Z",
    "dateUpdated": "2026-08-05T12:27:53.626Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-43433",
      "date": "2026-08-27",
      "epss": "0.00099",
      "percentile": "0.00871"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-43433\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-08T15:16:55.607\",\"lastModified\":\"2026-06-17T10:49:35.500\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nrust_binder: avoid reading the written value in offsets array\\n\\nWhen sending a transaction, its offsets array is first copied into the\\ntarget proc\u0027s vma, and then the values are read back from there. This is\\nnormally fine because the vma is a read-only mapping, so the target\\nprocess cannot change the value under us.\\n\\nHowever, if the target process somehow gains the ability to write to its\\nown vma, it could change the offset before it\u0027s read back, causing the\\nkernel to misinterpret what the sender meant. If the sender happens to\\nsend a payload with a specific shape, this could in the worst case lead\\nto the receiver being able to privilege escalate into the sender.\\n\\nThe intent is that gaining the ability to change the read-only vma of\\nyour own process should not be exploitable, so remove this TOCTOU read\\neven though it\u0027s unexploitable without another Binder bug.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/android/binder/thread.rs\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"eafedbc7c050c44744fbdf80bdf3315e860b7513\",\"lessThan\":\"e19afb53f7723b3bd22224f2b0c7dcfa70bb973f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"eafedbc7c050c44744fbdf80bdf3315e860b7513\",\"lessThan\":\"3672141c93b7a0c0132bf5d5021a4b7f1d663aaa\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"eafedbc7c050c44744fbdf80bdf3315e860b7513\",\"lessThan\":\"4cb9e13fec0de7c942f5f927469beb8e48ddd20f\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/android/binder/thread.rs\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.19\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.9\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-367\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.18\",\"versionEndExcluding\":\"6.18.19\",\"matchCriteriaId\":\"4B3A7D3C-8D62-43DB-ADD2-83F0634E4C23\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.9\",\"matchCriteriaId\":\"E825E7C3-FEAC-4FD3-8A81-78D7387948C9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"F253B622-8837-4245-BCE5-A7BF8FC76A16\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F666C8D8-6538-46D4-B318-87610DE64C34\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3672141c93b7a0c0132bf5d5021a4b7f1d663aaa\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4cb9e13fec0de7c942f5f927469beb8e48ddd20f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e19afb53f7723b3bd22224f2b0c7dcfa70bb973f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-28T11:27:38+00:00",
      "cve": "CVE-2026-43433",
      "id": "CVE-2026-43433",
      "initial_release_date": "2026-05-08T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: rust_binder: avoid reading the written value in offsets array",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43433.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.