CVE-2026-23400

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

rust_binder: call set_notification_done() without proc lock

Consider the following sequence of events on a death listener:

1. The remote process dies and sends a BR_DEAD_BINDER message.

2. The local process invokes the BC_CLEAR_DEATH_NOTIFICATION command.

3. The local process then invokes the BC_DEAD_BINDER_DONE.

Then, the kernel will reply to the BC_DEAD_BINDER_DONE command with a

BR_CLEAR_DEATH_NOTIFICATION_DONE reply using push_work_if_looper().

However, this can result in a deadlock if the current thread is not a

looper. This is because dead_binder_done() still holds the proc lock

during set_notification_done(), which called push_work_if_looper().

Normally, push_work_if_looper() takes the thread lock, which is fine to

take under the proc lock. But if the current thread is not a looper,

then it falls back to delivering the reply to the process work queue,

which involves taking the proc lock. Since the proc lock i

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References