CVE-2025-71181 rust_binder: remove spin_lock() in rust_shrink_free_page()
A recursive locking bug in the Rust Binder driver causes a deadlock and system crash during memory reclamation, requiring a kernel patch.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-71181?
CVE-2025-71181 is a medium-severity vulnerability in Linux kernel, published on 31 Jan 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
rust_binder: remove spin_lock() in rust_shrink_free_page()
When forward-porting Rust Binder to 6.18, I neglected to take commit fb56fdf8b9a2 ("mm/list_lru: split the lock to per-cgroup scope") into account, and apparently I did not end up running the shrinker callback when I sanity tested the driver before submission. This leads to crashes like the following:
============================================ WARNING: possible recursive locking detected 6.18.0-mainline-maybe-dirty #1 Tainted: G IO -------------------------------------------- kswapd0/68 is trying to acquire lock: ffff956000fa18b0 (&l->lock){+.+.}-{2:2}, at: lock_list_lru_of_memcg+0x128/0x230
but task is already holding lock: ffff956000fa18b0 (&l->lock){+.+.}-{2:2}, at: rust_helper_spin_lock+0xd/0x20
other info that might help us debug this: Possible unsafe locking scenario:
CPU0 ---- lock(&l->lock); lock(&l->lock);
*** DEADLOCK ***
May be due to missing lock nesting notation
3 locks held by kswapd0/68: #0: ffffffff90d2e260 (fs_reclaim){+.+.}-{0:0}, at: kswapd+0x597/0x1160 #1: ffff956000fa18b0 (&l->lock){+.+.}-{2:2}, at: rust_helper_spin_lock+0xd/0x20 #2: ffffffff90cf3680 (rcu_read_lock){....}-{1:2}, at: lock_list_lru_of_memcg+0x2d/0x230
To fix this, remove the spin_lock() call from rust_shrink_free_page().
Weakness: CWE-667
Which versions are affected by CVE-2025-71181?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-71181?
Apply the vendor's patch.
Is CVE-2025-71181 being exploited?
There is no known exploitation of CVE-2025-71181 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2025-71181, DEBIAN-CVE-2025-71181, GHSA-3qhg-rc86-rh99, UBUNTU-CVE-2025-71181.