In the Linux kernel, the following vulnerability has been resolved:
android: binder: stop saving a pointer to the VMA
Do not record a pointer to a VMA outside of the mmap_lock for later use. This is unsafe and there are a number of failure paths *after* the recorded VMA pointer may be freed during setup. There is no callback to the driver to clear the saved pointer from generic mm code. Furthermore, the VMA pointer may become stale if any number of VMA operations end up freeing the VMA so saving it was fragile to being with.
Instead, change the binder_alloc struct to record the start address of the VMA and use vma_lookup() to get the vma when needed. Add lockdep mmap_lock checks on updates to the vma pointer to ensure the lock is held and depend on that lock for synchronization of readers and writers - which was already the case anyways, so the smp_wmb()/smp_rmb() was not necessary.
[[email protected]: fix drivers/android/binder_alloc_selftest.c]
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-tools-debuginfoUpgrade python-perfUpgrade kernel-develUpgrade kernel-headersUpgrade python-perf-debuginfoUpgrade kernel-tools-develUpgrade kernel-livepatch-5.15.117-72.142Upgrade kernel-livepatch-5.10.155-138.670Upgrade kernel-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade perf-debuginfoUpgrade perfUpgrade kernel-toolsUpgrade bpftoolUpgrade kernelUpgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-x86_64 | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade kernel-tools-debuginfoUpgrade kernel-tools-develUpgrade kernel-libbpf-develUpgrade kernel-debuginfoUpgrade perf-debuginfoUpgrade kernel-develUpgrade kernel-livepatch-6.1.34-56.100Upgrade perfUpgrade kernel-libbpfUpgrade kernelUpgrade kernel-headersUpgrade kernel-libbpf-staticUpgrade kernel-debuginfo-common-aarch64Upgrade python3-perfUpgrade bpftoolUpgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-toolsUpgrade python3-perf-debuginfo | Oct 16, 2025 | Sep 15, 2025 |
| Debian | — | Upgrade linux | Sep 17, 2025 | Sep 17, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 15, 2025 | Sep 15, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub