CVE-2026-43434
published 2026-05-08CVE-2026-43434: In the Linux kernel, the following vulnerability has been resolved: rust_binder: check ownership before using vma When installing missing pages (or zapping…
PriorityP341high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.13%
2.8th percentile
In the Linux kernel, the following vulnerability has been resolved:
rust_binder: check ownership before using vma
When installing missing pages (or zapping them), Rust Binder will look
up the vma in the mm by address, and then call vm_insert_page (or
zap_page_range_single). However, if the vma is closed and replaced with
a different vma at the same address, this can lead to Rust Binder
installing pages into the wrong vma.
By installing the page into a writable vma, it becomes possible to write
to your own binder pages, which are normally read-only. Although you're
not supposed to be able to write to those pages, the intent behind the
design of Rust Binder is that even if you get that ability, it should not
lead to anything bad. Unfortunately, due to another bug, that is not the
case.
To fix this, store a pointer in vm_private_data and check that the vma
returned by vma_lookup() has the right vm_ops and vm_private_data before
trying to use the vma. This should ensure that Rust Binder will refuse
to interact with any other VMA. The plan is to introduce more vma
abstractions to avoid this unsafe access to vm_ops and vm_private_data,
but for now let's start with the simplest possible fix.
C Binder performs the same check in a slightly different way: it
provides a vm_ops->close that sets a boolean to true, then checks that
boolean after calling vma_lookup(), but this is more fragile
than the solution in this patch. (We probably still want to do both, but
the vm_ops->close callback will be added later as part of the follow-up
vma API changes.)
It's still possible to remap the vma so that pages appear in the right
vma, but at the wrong offset, but this is a separate issue and will be
fixed when Rust Binder gets a vm_ops->close callback.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= eafedbc7c050c44744fbdf80bdf3315e860b7513 < 20a01f20d1f4064d90a8627aa41b5987f0220bb9 | 20a01f20d1f4064d90a8627aa41b5987f0220bb9 |
| linux | linux | >= eafedbc7c050c44744fbdf80bdf3315e860b7513 < 5a472d04fb4b9115fb7d1535bd885cea450f14db | 5a472d04fb4b9115fb7d1535bd885cea450f14db |
| linux | linux | >= eafedbc7c050c44744fbdf80bdf3315e860b7513 < 8ef2c15aeae07647f530d30f6daaf79eb801bcd1 | 8ef2c15aeae07647f530d30f6daaf79eb801bcd1 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 6.18 < 6.18.19 | 6.18.19 |
| linux | linux_kernel | >= 6.19 < 6.19.9 | 6.19.9 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Linux Kernel up to 6.18.18/6.19.8 vma_lookup privilege escalation
vuldb·2026-05-08
CVE-2026-43434 [LOW] Linux Kernel up to 6.18.18/6.19.8 vma_lookup privilege escalation
A vulnerability was found in Linux Kernel up to 6.18.18/6.19.8. It has been declared as problematic. This issue affects the function vma_lookup. The manipulation results in privilege escalation.
This vulnerability is identified as CVE-2026-43434. The attack can only be performed from the local network. There is not any exploit available.
It is recommended to upgrade the affected component.
GHSA
GHSA-8r2v-c988-jpq4: In the Linux kernel, the following vulnerability has been resolved:
rust_binder: check ownership before using vma
When installing missing pages (or
ghsa_unreviewed·2026-05-08
CVE-2026-43434 GHSA-8r2v-c988-jpq4: In the Linux kernel, the following vulnerability has been resolved:
rust_binder: check ownership before using vma
When installing missing pages (or
In the Linux kernel, the following vulnerability has been resolved:
rust_binder: check ownership before using vma
When installing missing pages (or zapping them), Rust Binder will look
up the vma in the mm by address, and then call vm_insert_page (or
zap_page_range_single). However, if the vma is closed and replaced with
a different vma at the same address, this can lead to Rust Binder
installing pages into the wrong vma.
By installing the page into a writable vma, it becomes possible to write
to your own binder pages, which are normally read-only. Although you're
not supposed to be able to write to those pages, the intent behind the
design of Rust Binder is that even if you get that ability, it should not
lead to anything bad. Unfortunately, due to another bug, that is not the
case.
T
Red Hat
kernel: rust_binder: check ownership before using vma
vendor_redhat·2026-05-08
CVE-2026-43434 CWE-367 kernel: rust_binder: check ownership before using vma
kernel: rust_binder: check ownership before using vma
A flaw was found in the `rust_binder` component of the Linux kernel. When installing or zapping pages, `rust_binder` may incorrectly look up and use a Virtual Memory Area (VMA) if it has been closed and replaced at the same address. This can allow a local attacker to write to normally read-only binder pages, which, when combined with another vulnerability, could potentially lead to privilege escalation.
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Not affected
Package: kernel-rt (Red Hat
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-43434 kernel: rust_binder: check ownership before using vma
bugzilla·2026-05-08
CVE-2026-43434 CVE-2026-43434 kernel: rust_binder: check ownership before using vma
CVE-2026-43434 kernel: rust_binder: check ownership before using vma
In the Linux kernel, the following vulnerability has been resolved:
rust_binder: check ownership before using vma
When installing missing pages (or zapping them), Rust Binder will look
up the vma in the mm by address, and then call vm_insert_page (or
zap_page_range_single). However, if the vma is closed and replaced with
a different vma at the same address, this can lead to Rust Binder
installing pages into the wrong vma.
By installing the page into a writable vma, it becomes possible to write
to your own binder pages, which are normally read-only. Although you're
not supposed to be able to write to those pages, the intent behind the
design of Rust Binder is that even if you get that ability, it should not
lead to any
Bugzilla
CVE-2025-43434 webkit2gtk4.0: Processing maliciously crafted web content may lead to an unexpected Safari crash [fedora-42]
bugzilla·2025-11-21·CVSS 4.3
CVE-2025-43434 [MEDIUM] CVE-2025-43434 webkit2gtk4.0: Processing maliciously crafted web content may lead to an unexpected Safari crash [fedora-42]
CVE-2025-43434 webkit2gtk4.0: Processing maliciously crafted web content may lead to an unexpected Safari crash [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It
2026-05-08
Published