LiveActive security incident?Get immediate response
CVE Record

CVE-2025-71181: rust_binder: remove spin_lock() in rust_shrink_free_page()

In the Linux kernel, the following vulnerability has been resolved: rust_binder: remove spin_lock() in rust_shrink_free_page() When forward-porting Rust Binder to 6.18, I neglected to take commit fb56fdf8b9a2 ("mm/list_lru: split the lock to per-cgroup scope") into account, and apparently I did not end up running the shrinker callback when I sanity tested the driver before submission. This leads to crashes like the following: ============================================ WARNING: possible recursive locking detected 6.18.0-mainline-maybe-dirty #1 Tainted: G IO -------------------------------------------- kswapd0/68 is trying to acquire lock: ffff956000fa18b0 (&l->lock){+.+.}-{2:2}, at: lock_list_lru_of_memcg+0x128/0x230 but task is already holding lock: ffff956000fa18b0 (&l->lock){+.+.}-{2:2}, at: rust_helper_spin_lock+0xd/0x20 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&l->lock); lock(&l->lock); *** DEADLOCK *** May be due to missing lock nesting notation 3 locks held by kswapd0/68: #0: ffffffff90d2e260 (fs_reclaim){+.+.}-{0:0}, at: kswapd+0x597/0x1160 #1: ffff956000fa18b0 (&l->lock){+.+.}-{2:2}, at: rust_helper_spin_lock+0xd/0x20 #2: ffffffff90cf3680 (rcu_read_lock){....}-{1:2}, at: lock_list_lru_of_memcg+0x2d/0x230 To fix this, remove the spin_lock() call from rust_shrink_free_page().

UnknownCVSS not scoredNot KEV-listedUpdated
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2025-71181 is a Linux kernel Rust Binder bug that can cause recursive locking during memory reclaim. The public record describes kernel warnings, deadlock risk, and crashes, not data theft or remote compromise. Severity is not scored in the provided sources.

Executive priority

Treat as a kernel availability risk with uncertain severity. Patch through normal kernel maintenance, escalating priority for systems using Rust Binder or showing crash symptoms. There is no sourced evidence of active exploitation.

Technical view

The issue is in rust_binder, specifically rust_shrink_free_page(). A forward-port to Linux 6.18 missed a list_lru locking change, causing the shrinker callback to take a spin lock already held through lock_list_lru_of_memcg. The fix removes the extra spin_lock() call.

Likely exposure

Exposure appears limited to Linux systems running affected 6.18-era kernel code with Rust Binder present and reachable. The source bundle does not identify distributions, appliances, cloud images, or configurations beyond Linux kernel versions and commits.

Exploitation context

The CVE is not listed as KEV in the provided bundle. Sources describe crashes and possible recursive locking detected by kernel lock debugging. No cited source claims active exploitation, public exploit code, or remote attackability.

Researcher notes

The record attributes the issue to missing consideration of commit fb56fdf8b9a2 during Rust Binder forward-porting to 6.18. Available evidence supports a locking/deadlock flaw in reclaim paths, but not confidentiality impact, privilege escalation, or exploitability details.

Mitigation direction

  • Apply Linux kernel updates that include the referenced stable fixes.
  • Prioritize systems running affected 6.18-series kernels with Rust Binder enabled.
  • Check distribution or vendor advisories for backported fixes and package names.
  • If patching is delayed, assess whether Rust Binder is required on exposed systems.

Validation and detection

  • Inventory kernel versions and match them against vendor-fixed releases.
  • Review kernel configuration and modules for Rust Binder availability.
  • Check kernel logs for recursive locking, deadlock, shrinker, or rust_binder crash messages.
  • Confirm installed kernels include the referenced stable commits or vendor backports.
Prepared
Confidence
medium
Sources
4

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-71181 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
3Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxeafedbc7c050c44744fbdf80bdf3315e860b7513, eafedbc7c050c44744fbdf80bdf3315e860b7513unaffected
LinuxLinux6.18, 0, 6.18.6, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.