LiveActive security incident?Get immediate response
CVE Record

CVE-2026-23194: rust_binder: correctly handle FDA objects of length zero

In the Linux kernel, the following vulnerability has been resolved: rust_binder: correctly handle FDA objects of length zero Fix a bug where an empty FDA (fd array) object with 0 fds would cause an out-of-bounds error. The previous implementation used `skip == 0` to mean "this is a pointer fixup", but 0 is also the correct skip length for an empty FDA. If the FDA is at the end of the buffer, then this results in an attempt to write 8-bytes out of bounds. This is caught and results in an EINVAL error being returned to userspace. The pattern of using `skip == 0` as a special value originates from the C-implementation of Binder. As part of fixing this bug, this pattern is replaced with a Rust enum. I considered the alternate option of not pushing a fixup when the length is zero, but I think it's cleaner to just get rid of the zero-is-special stuff. The root cause of this bug was diagnosed by Gemini CLI on first try. I used the following prompt: > There appears to be a bug in @drivers/android/binder/thread.rs where > the Fixups oob bug is triggered with 316 304 316 324. This implies > that we somehow ended up with a fixup where buffer A has a pointer to > buffer B, but the pointer is located at an index in buffer A that is > out of bounds. Please investigate the code to find the bug. You may > compare with @drivers/android/binder.c that implements this correctly.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue affects the Rust Binder driver’s handling of an empty file-descriptor array. A malformed Binder object can trigger an out-of-bounds write attempt, but the source says the bounds check catches it and returns EINVAL to userspace.

Executive priority

Treat as a targeted kernel maintenance item, not an emergency from current evidence. Prioritize systems using Binder or affected kernel branches, and fold the fix into normal kernel patch cycles unless vendor guidance raises severity.

Technical view

In rust_binder, skip length zero was overloaded to mean pointer fixup, but zero is valid for an empty FDA object. If that FDA sits at buffer end, the code attempts an 8-byte out-of-bounds write. The fix replaces the zero-as-special-value pattern with a Rust enum.

Likely exposure

Exposure appears limited to Linux systems using affected kernel builds with Rust Binder enabled. Binder-heavy environments are most relevant. The bundle lists Linux 6.18 and 6.19 version data, but provides no distro package mapping or deployment prevalence.

Exploitation context

The source bundle does not report active exploitation, and KEV is false. The described outcome is an EINVAL returned to userspace after the out-of-bounds condition is caught, not confirmed code execution or privilege escalation.

Researcher notes

Evidence is narrow but credible: the CVE description explains root cause and fix direction. Missing data includes CVSS, CWE, exploitability assessment, affected distro packages, and operational impact beyond EINVAL returned to userspace.

Mitigation direction

  • Update to a Linux kernel build containing the referenced stable fixes.
  • Check distribution advisories for backported kernel packages.
  • Prioritize Binder-enabled systems before general-purpose servers without Binder usage.
  • Track vendor guidance because no CVSS score is provided in the bundle.

Validation and detection

  • Inventory kernel versions and identify 6.18 or 6.19 affected builds.
  • Confirm whether Rust Binder is enabled or loaded on relevant systems.
  • Verify whether stable commits 598fe3ff or 8f589c9 are present.
  • Check vendor kernel changelogs for CVE-2026-23194 backports.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-23194 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
3Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxeafedbc7c050c44744fbdf80bdf3315e860b7513, eafedbc7c050c44744fbdf80bdf3315e860b7513unaffected
LinuxLinux6.18, 0, 6.18.10, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.