CVE-2026-43435

Root

Cause

The vulnerability resides in the Linux kernel's rust_binder implementation, specifically in the oneway spam detection logic for the binder transaction range allocator. In TreeRange, the spam check was executed before inserting the current request into the tree, meaning the new request was not factored into the calculation. Additionally, ArrayRange entirely lacked a low_oneway_space() equivalent, allowing large batches of oneway transactions to bypass detection entirely [1].

Exploitation

An attacker with local access and the ability to submit binder transactions could exploit this flaw by sending a high volume of oneway (asynchronous) transactions. Without proper spam detection, the binder driver may allocate excessive resources for pending oneway transactions, potentially leading to denial-of-service (DoS) conditions. The vulnerability allows the attacker to flood the system with binder transactions without being throttled [1].

Impact

Successful exploitation could enable a local unprivileged attacker to cause a denial-of-service (resource exhaustion) on the binder driver, impacting overall system stability and availability. The vulnerability is in the Android/Linux binder subsystem used heavily for inter-process communication, so critical services may become unresponsive.

Mitigation

Mitigation

A fix was applied in Linux kernel stable commit 4fc87c240b8f [1]. The patch moves the spam detection in TreeRange to after insertion and adds an equivalent low_oneway_space() check to ArrayRange. Users should apply kernel updates containing this commit, or any downstream stable release that backports it.