New Linux Kernel Rust Vulnerability Triggers System Crashes
A critical race condition vulnerability has been identified in the Linux kernel's Rust Binder module, which may result in system crashes and memory corruption.
A critical race condition vulnerability has been identified in the Linux kernel's Rust Binder module, which may result in system crashes and memory corruption.
Designated as CVE-2025-68260 , this issue affects the kernel's inter-process communication mechanism. It is essential for system administrators and kernel maintainers to address this vulnerability promptly.
The vulnerability is located in the Rust Binder component's death_list handling mechanism. It is caused by an unsafe operation that removes items from a linked list without proper synchronization.
The code attempts to manipulate list pointers without ensuring exclusive access, leading to a race condition. This issue originates from the implementation pattern in the Node::release function, where a lock is acquired, list items are moved to a local stack-based list, and then the lock is released before iterating through the items.
This process creates a potential for concurrent access to the prev/next pointers, resulting in memory corruption . When triggered, the race condition causes kernel panics and page faults with errors such as "Unable to handle kernel paging request at virtual address."
Designated as CVE-2025-68260 , this issue affects the kernel's inter-process communication mechanism.
The vulnerability results in internal memory corruption, leading to kernel oops messages and system instability. Affected devices may experience unexpected reboots and service interruptions.
The issue was introduced in kernel version 6.18 with specific changes to the binder code, affecting the drivers/android/binder/node.rs file. The vulnerability has been patched in kernel 6.18.1 and 6.19-rc1, with fixes available in upstream kernel repositories.
The Linux kernel development team strongly advises updating to the latest stable kernel version. Full kernel updates are preferred over individual commit cherry-picks, as changes are tested as part of larger releases.
Users who cannot update immediately can apply specific commits from the kernel repositories to address this race condition.
System administrators should prioritize patching this vulnerability to ensure system stability and prevent unexpected downtime.
Based on reporting by GBHackers.
