CVE-2026-23194

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

rust_binder: correctly handle FDA objects of length zero

Fix a bug where an empty FDA (fd array) object with 0 fds would cause an

out-of-bounds error. The previous implementation used `skip == 0` to

mean "this is a pointer fixup", but 0 is also the correct skip length

for an empty FDA. If the FDA is at the end of the buffer, then this

results in an attempt to write 8-bytes out of bounds. This is caught and

results in an EINVAL error being returned to userspace.

The pattern of using `skip == 0` as a special value originates from the

C-implementation of Binder. As part of fixing this bug, this pattern is

replaced with a Rust enum.

I considered the alternate option of not pushing a fixup when the length

is zero, but I think it's cleaner to just get rid of the zero-is-special

stuff.

The root cause of this bug was diagnosed by Gemini CLI on first try. I

used the following prompt:

> There appears to be a bug in @driver

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References