LiveActive security incident?Get immediate response
CVE Record

CVE-2025-40028: binder: fix double-free in dbitmap

In the Linux kernel, the following vulnerability has been resolved: binder: fix double-free in dbitmap A process might fail to allocate a new bitmap when trying to expand its proc->dmap. In that case, dbitmap_grow() fails and frees the old bitmap via dbitmap_free(). However, the driver calls dbitmap_free() again when the same process terminates, leading to a double-free error: ================================================================== BUG: KASAN: double-free in binder_proc_dec_tmpref+0x2e0/0x55c Free of addr ffff00000b7c1420 by task kworker/9:1/209 CPU: 9 UID: 0 PID: 209 Comm: kworker/9:1 Not tainted 6.17.0-rc6-dirty #5 PREEMPT Hardware name: linux,dummy-virt (DT) Workqueue: events binder_deferred_func Call trace: kfree+0x164/0x31c binder_proc_dec_tmpref+0x2e0/0x55c binder_deferred_func+0xc24/0x1120 process_one_work+0x520/0xba4 [...] Allocated by task 448: __kmalloc_noprof+0x178/0x3c0 bitmap_zalloc+0x24/0x30 binder_open+0x14c/0xc10 [...] Freed by task 449: kfree+0x184/0x31c binder_inc_ref_for_node+0xb44/0xe44 binder_transaction+0x29b4/0x7fbc binder_thread_write+0x1708/0x442c binder_ioctl+0x1b50/0x2900 [...] ================================================================== Fix this issue by marking proc->map NULL in dbitmap_free().

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A local, low-privileged process can trigger a Linux Binder memory-management error that frees the same memory twice. This may crash the system or potentially compromise kernel confidentiality and integrity. Successful triggering requires access to the Binder driver and a failed bitmap expansion allocation.

Executive priority

Treat as a high-priority patching issue on shared, Android-derived, container-hosting, or otherwise locally exposed systems using Binder. Internet-only exposure is not indicated. Accelerate remediation where untrusted users or workloads have local access; otherwise include it in the next controlled kernel update cycle.

Technical view

When Binder expands a process bitmap, an allocation failure causes dbitmap_grow() to free the existing bitmap. Process cleanup later frees it again because the pointer remains set. The published correction clears the pointer during dbitmap_free(), preventing the second free. CVSS 3.1 rates it 7.8: local access, low complexity, low privileges, no user interaction.

Likely exposure

Exposure is limited to Linux systems running an affected kernel with the Binder driver available to untrusted local processes. The supplied version data includes 6.11, 6.12.52, 6.16.12, 6.17.2, and 6.18, but does not provide sufficiently clear branch boundaries. Confirm status through the system or distribution vendor.

Exploitation context

The supplied record is not in CISA KEV and provides no evidence of exploitation in the wild. Exploitation requires local, low-privileged access and Binder interaction. The allocation-failure condition may make reliable triggering environment-dependent, but the stated potential impact spans confidentiality, integrity, and availability.

Researcher notes

The demonstrated failure occurs after dbitmap_grow() frees the old bitmap on allocation failure and deferred process teardown frees it again. KASAN identified the second free in binder_proc_dec_tmpref(). The source bundle does not establish exploit reliability, affected configuration breadth, or whether memory corruption has been weaponized.

Mitigation direction

  • Install a vendor-supported kernel update that incorporates the referenced stable fix.
  • Prioritize systems exposing Binder to untrusted or low-privileged local processes.
  • Restrict unnecessary local access while updates are evaluated and deployed.
  • Check distribution security guidance for exact affected and fixed package versions.

Validation and detection

  • Inventory kernel versions and determine whether Binder is enabled and accessible.
  • Compare installed kernel packages against current distribution or appliance vendor advisories.
  • Confirm the deployed kernel contains the applicable referenced stable fix.
  • Review kernel logs for Binder-related KASAN double-free reports or unexplained crashes.
Prepared
Confidence
high
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-40028 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
5Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2025-40028Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux15d9da3f818cae676f822a04407d3c17b53357d2, 15d9da3f818cae676f822a04407d3c17b53357d2, 15d9da3f818cae676f822a04407d3c17b53357d2, 15d9da3f818cae676f822a04407d3c17b53357d2unaffected
LinuxLinux6.11, 0, 6.12.52, 6.16.12, 6.17.2, 6.18affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.