CVE-2026-43433 rust_binder: avoid reading the written value in offsets array
A race condition in the Linux kernel's Rust binder allows privilege escalation if a target process can modify its read-only memory mapping.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43433?
CVE-2026-43433 is a high-severity vulnerability in Linux kernel, published on 8 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
rust_binder: avoid reading the written value in offsets array
When sending a transaction, its offsets array is first copied into the target proc's vma, and then the values are read back from there. This is normally fine because the vma is a read-only mapping, so the target process cannot change the value under us.
However, if the target process somehow gains the ability to write to its own vma, it could change the offset before it's read back, causing the kernel to misinterpret what the sender meant. If the sender happens to send a payload with a specific shape, this could in the worst case lead to the receiver being able to privilege escalate into the sender.
The intent is that gaining the ability to change the read-only vma of your own process should not be exploitable, so remove this TOCTOU read even though it's unexploitable without another Binder bug.
Weakness: CWE-367
Which versions are affected by CVE-2026-43433?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-43433?
Apply the vendor's patch.
Is CVE-2026-43433 being exploited?
There is no known exploitation of CVE-2026-43433 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-43433, DEBIAN-CVE-2026-43433, GHSA-9ccw-3qr7-6wpp, UBUNTU-CVE-2026-43433.