CVE-2025-40028

Root

Cause

A double-free vulnerability exists in the Linux kernel's binder driver within the dbitmap memory management code. When a process attempts to expand its proc->dmap via dbitmap_grow(), a memory allocation failure causes the old bitmap to be freed through dbitmap_free(). However, the function does not set proc->map to NULL after freeing the bitmap, leaving a dangling pointer. Later, when the process terminates, binder_proc_dec_tmpref() calls dbitmap_free() again on the same pointer, resulting in a double-free that is detected by KASAN [1],[2].

Exploitation

Context

The vulnerability can be triggered by a local user who opens a binder device and performs binder transactions that cause the process's bitmap to be expanded. If the expansion fails (e.g., due to memory pressure), the dangling pointer remains. Upon process exit, the deferred workqueue (binder_deferred_func) invokes the cleanup path that frees the already-freed bitmap, leading to a kernel memory corruption [1].

Impact

A double-free in kernel memory can corrupt the kernel heap, potentially leading to a denial-of-service (system crash) or, in some cases, privilege escalation if an attacker can manipulate the freed memory to achieve code execution. The KASAN report clearly shows the double-free occurring during process termination [1].

Mitigation

The fix, included in stable kernel commits, ensures that dbitmap_free() sets proc->map to NULL after freeing the bitmap, preventing a second free on the same pointer. Users should update to a kernel version containing the fix, or apply the relevant patch [1],[2].