CVE-2025-71181

published 2026-01-31

CVE-2025-71181: In the Linux kernel, the following vulnerability has been resolved: rust_binder: remove spin_lock() in rust_shrink_free_page() When forward-porting Rust Binder…

Priority P4 20 medium 5.5 CVSS 3.1

AV L AC L PR L UI N S U C N I N A H

In the Linux kernel, the following vulnerability has been resolved:

rust_binder: remove spin_lock() in rust_shrink_free_page()

When forward-porting Rust Binder to 6.18, I neglected to take commit
fb56fdf8b9a2 ("mm/list_lru: split the lock to per-cgroup scope") into
account, and apparently I did not end up running the shrinker callback
when I sanity tested the driver before submission. This leads to crashes
like the following:

WARNING: possible recursive locking detected
6.18.0-mainline-maybe-dirty #1 Tainted: G IO
kswapd0/68 is trying to acquire lock:
ffff956000fa18b0 (&l->lock){+.+.}-{2:2}, at: lock_list_lru_of_memcg+0x128/0x230

but task is already holding lock:
ffff956000fa18b0 (&l->lock){+.+.}-{2:2}, at: rust_helper_spin_lock+0xd/0x20

other info that might help us debug this:
Possible unsafe locking scenario:

CPU0
----
lock(&l->lock);
lock(&l->lock);

*** DEADLOCK ***

May be due to missing lock nesting notation

3 locks held by kswapd0/68:
#0: ffffffff90d2e260 (fs_reclaim){+.+.}-{0:0}, at: kswapd+0x597/0x1160
#1: ffff956000fa18b0 (&l->lock){+.+.}-{2:2}, at: rust_helper_spin_lock+0xd/0x20
#2: ffffffff90cf3680 (rcu_read_lock){....}-{1:2}, at: lock_list_lru_of_memcg+0x2d/0x230

To fix this, remove the spin_lock() call from rust_shrink_free_page().

Affected

9 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 6.18.8-1 (forky)	linux 6.18.8-1 (forky)
linux	linux	—	—
linux	linux	>= eafedbc7c050c44744fbdf80bdf3315e860b7513 < 30a98c97f7874031f2e1de19c777ce011143cba4	30a98c97f7874031f2e1de19c777ce011143cba4
linux	linux	>= eafedbc7c050c44744fbdf80bdf3315e860b7513 < 361e0ff456a8daf9753c18030533256e4133ce7a	361e0ff456a8daf9753c18030533256e4133ce7a
linux	linux_kernel	—	—
linux	linux_kernel	—	—
linux	linux_kernel	>= 0 < 6.18.8-1	6.18.8-1
linux	linux_kernel	>= 6.18.0 < 6.18.6	6.18.6
linux	linux_kernel	>= 6.18.1 < 6.18.6	6.18.6

CVSS provenance

nvd v3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

osv 5.5 MEDIUM

vendor_debian 5.5 LOW

vendor_redhat 5.5 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-667