CVE-2026-43434

In the Linux kernel, the following vulnerability has been resolved: rust_binder: check ownership before using vma When installing missing pages (or zapping them), Rust Binder will look up the vma in the mm by address, and then call vm_insert_page (or zap_page_range_single). However, if the vma is closed and replaced with a different vma at the same address, this can lead to Rust Binder installing pages into the wrong vma. By installing the page into a writable vma, it becomes possible to write to your own binder pages, which are normally read-only. Although you're not supposed to be able to write to those pages, the intent behind the design of Rust Binder is that even if you get that ability, it should not lead to anything bad. Unfortunately, due to another bug, that is not the case. To fix this, store a pointer in vm_private_data and check that the vma returned by vma_lookup() has the right vm_ops and vm_private_data before trying to use the vma. This should ensure that Rust Binder will refuse to interact with any other VMA. The plan is to introduce more vma abstractions to avoid this unsafe access to vm_ops and vm_private_data, but for now let's start with the simplest possible fix. C Binder performs the same check in a slightly different way: it provides a vm_ops->close that sets a boolean to true, then checks that boolean after calling vma_lookup(), but this is more fragile than the solution in this patch. (We probably still want to do both, but the vm_ops->close callback will be added later as part of the follow-up vma API changes.) It's still possible to remap the vma so that pages appear in the right vma, but at the wrong offset, but this is a separate issue and will be fixed when Rust Binder gets a vm_ops->close callback.

• https://git.kernel.org/stable/c/20a01f20d1f4064d90a8627aa41b5987f0220bb9Patch
• https://git.kernel.org/stable/c/5a472d04fb4b9115fb7d1535bd885cea450f14dbPatch
• https://git.kernel.org/stable/c/8ef2c15aeae07647f530d30f6daaf79eb801bcd1Patch

Published

May 8, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-43428In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-43429In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-43430In the Linux kernel, the following vulnerability has been re…4.7
• CVE-2026-43431In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-43432In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-43433In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-43435In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-43436In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-43437In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-43438In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-43439In the Linux kernel, the following vulnerability has been re…4.7
• CVE-2026-4344A maliciously crafted HTML payload in a component name, when…7.1