In the Linux kernel, the following vulnerability has been resolved:
android: binder: stop saving a pointer to the VMA
Do not record a pointer to a VMA outside of the mmap_lock for later use. This is unsafe and there are a number of failure paths *after* the recorded VMA pointer may be freed during setup. There is no callback to the driver to clear the saved pointer from generic mm code. Furthermore, the VMA pointer may become stale if any number of VMA operations end up freeing the VMA so saving it was fragile to being with.
Instead, change the binder_alloc struct to record the start address of the VMA and use vma_lookup() to get the vma when needed. Add lockdep mmap_lock checks on updates to the vma pointer to ensure the lock is held and depend on that lock for synchronization of readers and writers - which was already the case anyways, so the smp_wmb()/smp_rmb() was not necessary.
[[email protected]: fix drivers/android/binder_alloc_selftest.c]
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-develUpgrade kernel-tools-develUpgrade kernel-tools-debuginfoUpgrade perf-debuginfoUpgrade python-perf-debuginfoUpgrade kernel-livepatch-5.10.155-138.670Upgrade kernel-debuginfo-common-aarch64Upgrade python-perfUpgrade kernel-debuginfoUpgrade kernel-headersUpgrade kernel-toolsUpgrade kernel-livepatch-5.15.117-72.142Upgrade perfUpgrade kernelUpgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade bpftool | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade kernel-libbpf-develUpgrade perfUpgrade kernel-debuginfoUpgrade kernel-tools-debuginfoUpgrade perf-debuginfoUpgrade kernel-tools-develUpgrade kernel-headersUpgrade kernel-develUpgrade kernel-libbpf-staticUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-livepatch-6.1.34-56.100Upgrade kernel-libbpfUpgrade kernelUpgrade python3-perfUpgrade kernel-toolsUpgrade python3-perf-debuginfoUpgrade bpftoolUpgrade kernel-debuginfo-common-x86_64Upgrade bpftool-debuginfo | Oct 16, 2025 | Sep 15, 2025 |
| Debian | — | Upgrade linux | Sep 17, 2025 | Sep 17, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 15, 2025 | Sep 15, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub