CVE-2026-43434

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

rust_binder: check ownership before using vma

When installing missing pages (or zapping them), Rust Binder will look

up the vma in the mm by address, and then call vm_insert_page (or

zap_page_range_single). However, if the vma is closed and replaced with

a different vma at the same address, this can lead to Rust Binder

installing pages into the wrong vma.

By installing the page into a writable vma, it becomes possible to write

to your own binder pages, which are normally read-only. Although you're

not supposed to be able to write to those pages, the intent behind the

design of Rust Binder is that even if you get that ability, it should not

lead to anything bad. Unfortunately, due to another bug, that is not the

case.

To fix this, store a pointer in vm_private_data and check that the vma

returned by vma_lookup() has the right vm_ops and vm_private_data before

trying to use the vma. This should ensure that Rust Binde

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References