CVE-2025-71181: rust_binder: remove spin_lock() in rust_shrink_free_page()
In the Linux kernel, the following vulnerability has been resolved:
rust_binder: remove spin_lock() in rust_shrink_free_page()
When forward-porting Rust Binder to 6.18, I neglected to take commit
fb56fdf8b9a2 ("mm/list_lru: split the lock to per-cgroup scope") into
account, and apparently I did not end up running the shrinker callback
when I sanity tested the driver before submission. This leads to crashes
like the following:
============================================
WARNING: possible recursive locking detected
6.18.0-mainline-maybe-dirty #1 Tainted: G IO
--------------------------------------------
kswapd0/68 is trying to acquire lock:
ffff956000fa18b0 (&l->lock){+.+.}-{2:2}, at: lock_list_lru_of_memcg+0x128/0x230
but task is already holding lock:
ffff956000fa18b0 (&l->lock){+.+.}-{2:2}, at: rust_helper_spin_lock+0xd/0x20
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&l->lock);
lock(&l->lock);
*** DEADLOCK ***
May be due to missing lock nesting notation
3 locks held by kswapd0/68:
#0: ffffffff90d2e260 (fs_reclaim){+.+.}-{0:0}, at: kswapd+0x597/0x1160
#1: ffff956000fa18b0 (&l->lock){+.+.}-{2:2}, at: rust_helper_spin_lock+0xd/0x20
#2: ffffffff90cf3680 (rcu_read_lock){....}-{1:2}, at: lock_list_lru_of_memcg+0x2d/0x230
To fix this, remove the spin_lock() call from rust_shrink_free_page().
Security readout for executives and security teams
Plain-English summary
CVE-2025-71181 is a Linux kernel Rust Binder bug that can cause recursive locking during memory reclaim. The public record describes kernel warnings, deadlock risk, and crashes, not data theft or remote compromise. Severity is not scored in the provided sources.
Executive priority
Treat as a kernel availability risk with uncertain severity. Patch through normal kernel maintenance, escalating priority for systems using Rust Binder or showing crash symptoms. There is no sourced evidence of active exploitation.
Technical view
The issue is in rust_binder, specifically rust_shrink_free_page(). A forward-port to Linux 6.18 missed a list_lru locking change, causing the shrinker callback to take a spin lock already held through lock_list_lru_of_memcg. The fix removes the extra spin_lock() call.
Likely exposure
Exposure appears limited to Linux systems running affected 6.18-era kernel code with Rust Binder present and reachable. The source bundle does not identify distributions, appliances, cloud images, or configurations beyond Linux kernel versions and commits.
Exploitation context
The CVE is not listed as KEV in the provided bundle. Sources describe crashes and possible recursive locking detected by kernel lock debugging. No cited source claims active exploitation, public exploit code, or remote attackability.
Researcher notes
The record attributes the issue to missing consideration of commit fb56fdf8b9a2 during Rust Binder forward-porting to 6.18. Available evidence supports a locking/deadlock flaw in reclaim paths, but not confidentiality impact, privilege escalation, or exploitability details.
Mitigation direction
Apply Linux kernel updates that include the referenced stable fixes.
Prioritize systems running affected 6.18-series kernels with Rust Binder enabled.
Check distribution or vendor advisories for backported fixes and package names.
If patching is delayed, assess whether Rust Binder is required on exposed systems.
Validation and detection
Inventory kernel versions and match them against vendor-fixed releases.
Review kernel configuration and modules for Rust Binder availability.
Check kernel logs for recursive locking, deadlock, shrinker, or rust_binder crash messages.
Confirm installed kernels include the referenced stable commits or vendor backports.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2025-71181 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
0CVSS vectors
3Timeline events
0ADP providers
3Source links
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
CVE publishedCVE Program
The CVE record was published.
Jan 31, 2026, 11:38 UTC (UTC+00:00)
CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.