LiveActive security incident?Get immediate response
CVE Record

CVE-2026-43433: rust_binder: avoid reading the written value in offsets array

In the Linux kernel, the following vulnerability has been resolved: rust_binder: avoid reading the written value in offsets array When sending a transaction, its offsets array is first copied into the target proc's vma, and then the values are read back from there. This is normally fine because the vma is a read-only mapping, so the target process cannot change the value under us. However, if the target process somehow gains the ability to write to its own vma, it could change the offset before it's read back, causing the kernel to misinterpret what the sender meant. If the sender happens to send a payload with a specific shape, this could in the worst case lead to the receiver being able to privilege escalate into the sender. The intent is that gaining the ability to change the read-only vma of your own process should not be exploitable, so remove this TOCTOU read even though it's unexploitable without another Binder bug.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux kernel race condition in rust_binder could let a receiving process gain the sender’s privileges. Exploitation requires another Binder flaw that permits modification of a normally read-only memory area, plus a specially shaped transaction. The potential impact is severe, but the supplied sources do not establish active exploitation.

Executive priority

Treat as a high-priority kernel maintenance issue, especially on multi-user or application-isolation platforms using rust_binder. It does not warrant claims of an ongoing emergency from current evidence because exploitation depends on an additional Binder weakness and no active exploitation is cited. Schedule prompt, tested kernel updates through normal change controls.

Technical view

rust_binder copied transaction offsets into the target process’s read-only VMA, then read them back. If another Binder vulnerability made that VMA writable, the target could alter an offset between those operations, causing kernel misinterpretation and possible privilege escalation into the sender. The correction removes this time-of-check/time-of-use read from target-controlled memory.

Likely exposure

Exposure is limited to Linux systems using affected rust_binder code. The record names releases including 6.18, 6.18.19, 6.19.9, and 7.0, but its version metadata does not clearly define complete affected boundaries. Confirm exposure against the running distribution kernel and referenced stable fixes.

Exploitation context

The CVSS vector describes a local, low-privilege attack requiring no user interaction. However, the kernel description states this issue is not independently exploitable: an attacker must first gain write access to a normally read-only Binder VMA through another Binder bug. KEV is false, and no supplied source reports exploitation in the wild.

Researcher notes

The security boundary failure is a TOCTOU read of offsets after copying them into target-process memory. The worst case crosses privileges from receiver to sender. The record repeats commit eafedbc7c050 and provides unclear version boundaries, so repository or distributor backport verification is more reliable than version-string matching alone. No CWE is supplied.

Mitigation direction

  • Install a vendor-supported kernel containing the applicable referenced stable fix.
  • Prioritize systems exposing rust_binder to mutually untrusted local processes.
  • Check Linux distribution advisories for exact affected build and backport information.
  • Reduce untrusted local access where immediate kernel updates are unavailable.

Validation and detection

  • Record each system’s running kernel version and distribution build identifier.
  • Verify whether rust_binder is present, enabled, and reachable by untrusted processes.
  • Confirm the applicable stable fix or vendor backport exists in the installed kernel.
  • Recheck vendor advisories because the supplied affected-version boundaries are ambiguous.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-43433 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
4Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2026-43433Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxeafedbc7c050c44744fbdf80bdf3315e860b7513, eafedbc7c050c44744fbdf80bdf3315e860b7513, eafedbc7c050c44744fbdf80bdf3315e860b7513unaffected
LinuxLinux6.18, 0, 6.18.19, 6.19.9, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.