CVE-2026-43434

/* * PoC Concept: VMA Confusion in Rust Binder * This demonstrates the logic of replacing a VMA to trigger the bug. */ #include <sys/mman.h> #include <stdio.h> #include <unistd.h> int main() { void *addr; // 1. Allocate memory (simulating binder interaction) addr = mmap(NULL, 4096, PROT_READ, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); if (addr == MAP_FAILED) return -1; printf("[+] Original VMA at %p\n", addr); // 2. Race condition: Replace the VMA at the same address with a writable one // In a real exploit, this races with rust_binder's vma_lookup void *new_addr = mremap(addr, 4096, 4096, MREMAP_MAYMOVE | MREMAP_FIXED, addr); if (new_addr == MAP_FAILED) { perror("mremap failed"); } else { printf("[+] VMA replaced. Binder may now install pages into this writable VMA.\n"); // If vulnerability exists, the kernel page is now mapped writable here. } return 0; }

{"cve": {"id": "CVE-2026-43434", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2026-05-08T15:16:55.713", "lastModified": "2026-05-11T08:16:13.943", "vulnStatus": "Received", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrust_binder: check ownership before using vma\n\nWhen installing missing pages (or zapping them), Rust Binder will look\nup the vma in the mm by address, and then call vm_insert_page (or\nzap_page_range_single). However, if the vma is closed and replaced with\na different vma at the same address, this can lead to Rust Binder\ninstalling pages into the wrong vma.\n\nBy installing the page into a writable vma, it becomes possible to write\nto your own binder pages, which are normally read-only. Although you're\nnot supposed to be able to write to those pages, the intent behind the\ndesign of Rust Binder is that even if you get that ability, it should not\nlead to anything bad. Unfortunately, due to another bug, that is not the\ncase.\n\nTo fix this, store a pointer in vm_private_data and check that the vma\nreturned by vma_lookup() has the right vm_ops and vm_private_data before\ntrying to use the vma. This should ensure that Rust Binder will refuse\nto interact with any other VMA. The plan is to introduce more vma\nabstractions to avoid this unsafe access to vm_ops and vm_private_data,\nbut for now let's start with the simplest possible fix.\n\nC Binder performs the same check in a slightly different way: it\nprovides a vm_ops->close that sets a boolean to true, then checks that\nboolean after calling vma_lookup(), but this is more fragile\nthan the solution in this patch. (We probably still want to do both, but\nthe vm_ops->close callback will be added later as part of the follow-up\nvma API changes.)\n\nIt's still possible to remap the vma so that pages appear in the right\nvma, but at the wrong offset, but this is a separate issue and will be\nfixed when Rust Binder gets a vm_ops->close callback."}], "metrics": {"cvssMetricV31": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 5.9}]}, "references": [{"url": "https://git.kernel.org/stable/c/20a01f20d1f4064d90a8627aa41b5987f0220bb9", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/5a472d04fb4b9115fb7d1535bd885cea450f14db", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/8ef2c15aeae07647f530d30f6daaf79eb801bcd1", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}}