CVE-2026-23400 rust_binder: call set_notification_done() without proc lock
A deadlock in the Linux kernel's Rust binder implementation can cause a denial of service when specific IPC commands are used on non-looper threads.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23400?
CVE-2026-23400 is a medium-severity vulnerability in Linux kernel, published on 29 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
rust_binder: call set_notification_done() without proc lock
Consider the following sequence of events on a death listener: 1. The remote process dies and sends a BR_DEAD_BINDER message. 2. The local process invokes the BC_CLEAR_DEATH_NOTIFICATION command. 3. The local process then invokes the BC_DEAD_BINDER_DONE. Then, the kernel will reply to the BC_DEAD_BINDER_DONE command with a BR_CLEAR_DEATH_NOTIFICATION_DONE reply using push_work_if_looper().
However, this can result in a deadlock if the current thread is not a looper. This is because dead_binder_done() still holds the proc lock during set_notification_done(), which called push_work_if_looper(). Normally, push_work_if_looper() takes the thread lock, which is fine to take under the proc lock. But if the current thread is not a looper, then it falls back to delivering the reply to the process work queue, which involves taking the proc lock. Since the proc lock is already held, this is a deadlock.
Fix this by releasing the proc lock during set_notification_done(). It was not intentional that it was held during that function to begin with.
I don't think this ever happens in Android because BC_DEAD_BINDER_DONE is only invoked in response to BR_DEAD_BINDER messages, and the kernel always delivers BR_DEAD_BINDER to a looper. So there's no scenario where Android userspace will call BC_DEAD_BINDER_DONE on a non-looper thread.
Weakness: CWE-667
Which versions are affected by CVE-2026-23400?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-23400?
Apply the vendor's patch.
Is CVE-2026-23400 being exploited?
There is no known exploitation of CVE-2026-23400 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-23400, DEBIAN-CVE-2026-23400, GHSA-pff6-g7ww-p3v3, UBUNTU-CVE-2026-23400.