Following the initial report of the first vulnerability in Linux kernel Rust code, deeper analysis of CVE-2025-68260 in the Rust-based Binder module reveals a race condition in data list handling that causes memory corruption and system crashes. Detailed patches are available in kernel 6.18.1 and 6.19-rc1.
Identified in the Rust implementation of the Binder inter-process communication (IPC) mechanism—recently rewritten for Android in drivers/android/binder/node.rs—this flaw (CVE-2025-68260) centers on a race condition in the Node::release function.
The issue arises when a lock is acquired to access a shared linked list, items are moved to a temporary local stack, but the lock is released too early—before fully processing and iterating the items. This window allows concurrent kernel thread access to prev/next pointers, leading to memory corruption, kernel panics, unexpected reboots, service disruptions, and errors like kernel oops in logs.
Introduced in kernel 6.18 via a Binder update commit that missed synchronization, it heightens risks for Android systems and Binder-dependent servers.
Kernel maintainers quickly patched it in 6.18.1 and 6.19-rc1. Update to the latest stable kernel for full protection; upstream patches serve as interim fixes for critical environments.
