CVE-2025-38176 (GCVE-0-2025-38176)

Vulnerability from cvelistv5 – Published: 2025-07-04 10:39 – Updated: 2026-08-05 12:00
VLAI
Title
binder: fix use-after-free in binderfs_evict_inode()
Summary
In the Linux kernel, the following vulnerability has been resolved: binder: fix use-after-free in binderfs_evict_inode() Running 'stress-ng --binderfs 16 --timeout 300' under KASAN-enabled kernel, I've noticed the following: BUG: KASAN: slab-use-after-free in binderfs_evict_inode+0x1de/0x2d0 Write of size 8 at addr ffff88807379bc08 by task stress-ng-binde/1699 CPU: 0 UID: 0 PID: 1699 Comm: stress-ng-binde Not tainted 6.14.0-rc7-g586de92313fc-dirty #13 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x1c2/0x2a0 ? __pfx_dump_stack_lvl+0x10/0x10 ? __pfx__printk+0x10/0x10 ? __pfx_lock_release+0x10/0x10 ? __virt_addr_valid+0x18c/0x540 ? __virt_addr_valid+0x469/0x540 print_report+0x155/0x840 ? __virt_addr_valid+0x18c/0x540 ? __virt_addr_valid+0x469/0x540 ? __phys_addr+0xba/0x170 ? binderfs_evict_inode+0x1de/0x2d0 kasan_report+0x147/0x180 ? binderfs_evict_inode+0x1de/0x2d0 binderfs_evict_inode+0x1de/0x2d0 ? __pfx_binderfs_evict_inode+0x10/0x10 evict+0x524/0x9f0 ? __pfx_lock_release+0x10/0x10 ? __pfx_evict+0x10/0x10 ? do_raw_spin_unlock+0x4d/0x210 ? _raw_spin_unlock+0x28/0x50 ? iput+0x697/0x9b0 __dentry_kill+0x209/0x660 ? shrink_kill+0x8d/0x2c0 shrink_kill+0xa9/0x2c0 shrink_dentry_list+0x2e0/0x5e0 shrink_dcache_parent+0xa2/0x2c0 ? __pfx_shrink_dcache_parent+0x10/0x10 ? __pfx_lock_release+0x10/0x10 ? __pfx_do_raw_spin_lock+0x10/0x10 do_one_tree+0x23/0xe0 shrink_dcache_for_umount+0xa0/0x170 generic_shutdown_super+0x67/0x390 kill_litter_super+0x76/0xb0 binderfs_kill_super+0x44/0x90 deactivate_locked_super+0xb9/0x130 cleanup_mnt+0x422/0x4c0 ? lockdep_hardirqs_on+0x9d/0x150 task_work_run+0x1d2/0x260 ? __pfx_task_work_run+0x10/0x10 resume_user_mode_work+0x52/0x60 syscall_exit_to_user_mode+0x9a/0x120 do_syscall_64+0x103/0x210 ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0xcac57b Code: c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 f3 0f 1e fa 31 f6 e9 05 00 00 00 0f 1f 44 00 00 f3 0f 1e fa b8 RSP: 002b:00007ffecf4226a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 00007ffecf422720 RCX: 0000000000cac57b RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007ffecf422850 RBP: 00007ffecf422850 R08: 0000000028d06ab1 R09: 7fffffffffffffff R10: 3fffffffffffffff R11: 0000000000000246 R12: 00007ffecf422718 R13: 00007ffecf422710 R14: 00007f478f87b658 R15: 00007ffecf422830 </TASK> Allocated by task 1705: kasan_save_track+0x3e/0x80 __kasan_kmalloc+0x8f/0xa0 __kmalloc_cache_noprof+0x213/0x3e0 binderfs_binder_device_create+0x183/0xa80 binder_ctl_ioctl+0x138/0x190 __x64_sys_ioctl+0x120/0x1b0 do_syscall_64+0xf6/0x210 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 1705: kasan_save_track+0x3e/0x80 kasan_save_free_info+0x46/0x50 __kasan_slab_free+0x62/0x70 kfree+0x194/0x440 evict+0x524/0x9f0 do_unlinkat+0x390/0x5b0 __x64_sys_unlink+0x47/0x50 do_syscall_64+0xf6/0x210 entry_SYSCALL_64_after_hwframe+0x77/0x7f This 'stress-ng' workload causes the concurrent deletions from 'binder_devices' and so requires full-featured synchronization to prevent list corruption. I've found this issue independently but pretty sure that syzbot did the same, so Reported-by: and Closes: should be applicable here as well.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: e77aff5528a183462714f750e45add6cc71e276a , < 80ed8ab8efa0d18c03968a2321154f10e2d1a2e3 (git)
Affected: e77aff5528a183462714f750e45add6cc71e276a , < aea61a1a77613d4184d7ebe7c1d7cb606458b43b (git)
Affected: e77aff5528a183462714f750e45add6cc71e276a , < 8c0a559825281764061a127632e5ad273f0466ad (git)
Create a notification for this product.
Linux Linux Affected: 6.14
Unaffected: 0 , < 6.14 (semver)
Unaffected: 6.14.11 , ≤ 6.14.* (semver)
Unaffected: 6.15.2 , ≤ 6.15.* (semver)
Unaffected: 6.16 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/android/binder.c",
            "drivers/android/binder_internal.h",
            "drivers/android/binderfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "80ed8ab8efa0d18c03968a2321154f10e2d1a2e3",
              "status": "affected",
              "version": "e77aff5528a183462714f750e45add6cc71e276a",
              "versionType": "git"
            },
            {
              "lessThan": "aea61a1a77613d4184d7ebe7c1d7cb606458b43b",
              "status": "affected",
              "version": "e77aff5528a183462714f750e45add6cc71e276a",
              "versionType": "git"
            },
            {
              "lessThan": "8c0a559825281764061a127632e5ad273f0466ad",
              "status": "affected",
              "version": "e77aff5528a183462714f750e45add6cc71e276a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/android/binder.c",
            "drivers/android/binder_internal.h",
            "drivers/android/binderfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.11",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.2",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbinder: fix use-after-free in binderfs_evict_inode()\n\nRunning \u0027stress-ng --binderfs 16 --timeout 300\u0027 under KASAN-enabled\nkernel, I\u0027ve noticed the following:\n\nBUG: KASAN: slab-use-after-free in binderfs_evict_inode+0x1de/0x2d0\nWrite of size 8 at addr ffff88807379bc08 by task stress-ng-binde/1699\n\nCPU: 0 UID: 0 PID: 1699 Comm: stress-ng-binde Not tainted 6.14.0-rc7-g586de92313fc-dirty #13\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x1c2/0x2a0\n ? __pfx_dump_stack_lvl+0x10/0x10\n ? __pfx__printk+0x10/0x10\n ? __pfx_lock_release+0x10/0x10\n ? __virt_addr_valid+0x18c/0x540\n ? __virt_addr_valid+0x469/0x540\n print_report+0x155/0x840\n ? __virt_addr_valid+0x18c/0x540\n ? __virt_addr_valid+0x469/0x540\n ? __phys_addr+0xba/0x170\n ? binderfs_evict_inode+0x1de/0x2d0\n kasan_report+0x147/0x180\n ? binderfs_evict_inode+0x1de/0x2d0\n binderfs_evict_inode+0x1de/0x2d0\n ? __pfx_binderfs_evict_inode+0x10/0x10\n evict+0x524/0x9f0\n ? __pfx_lock_release+0x10/0x10\n ? __pfx_evict+0x10/0x10\n ? do_raw_spin_unlock+0x4d/0x210\n ? _raw_spin_unlock+0x28/0x50\n ? iput+0x697/0x9b0\n __dentry_kill+0x209/0x660\n ? shrink_kill+0x8d/0x2c0\n shrink_kill+0xa9/0x2c0\n shrink_dentry_list+0x2e0/0x5e0\n shrink_dcache_parent+0xa2/0x2c0\n ? __pfx_shrink_dcache_parent+0x10/0x10\n ? __pfx_lock_release+0x10/0x10\n ? __pfx_do_raw_spin_lock+0x10/0x10\n do_one_tree+0x23/0xe0\n shrink_dcache_for_umount+0xa0/0x170\n generic_shutdown_super+0x67/0x390\n kill_litter_super+0x76/0xb0\n binderfs_kill_super+0x44/0x90\n deactivate_locked_super+0xb9/0x130\n cleanup_mnt+0x422/0x4c0\n ? lockdep_hardirqs_on+0x9d/0x150\n task_work_run+0x1d2/0x260\n ? __pfx_task_work_run+0x10/0x10\n resume_user_mode_work+0x52/0x60\n syscall_exit_to_user_mode+0x9a/0x120\n do_syscall_64+0x103/0x210\n ? asm_sysvec_apic_timer_interrupt+0x1a/0x20\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0xcac57b\nCode: c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 f3 0f 1e fa 31 f6 e9 05 00 00 00 0f 1f 44 00 00 f3 0f 1e fa b8\nRSP: 002b:00007ffecf4226a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6\nRAX: 0000000000000000 RBX: 00007ffecf422720 RCX: 0000000000cac57b\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007ffecf422850\nRBP: 00007ffecf422850 R08: 0000000028d06ab1 R09: 7fffffffffffffff\nR10: 3fffffffffffffff R11: 0000000000000246 R12: 00007ffecf422718\nR13: 00007ffecf422710 R14: 00007f478f87b658 R15: 00007ffecf422830\n \u003c/TASK\u003e\n\nAllocated by task 1705:\n kasan_save_track+0x3e/0x80\n __kasan_kmalloc+0x8f/0xa0\n __kmalloc_cache_noprof+0x213/0x3e0\n binderfs_binder_device_create+0x183/0xa80\n binder_ctl_ioctl+0x138/0x190\n __x64_sys_ioctl+0x120/0x1b0\n do_syscall_64+0xf6/0x210\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFreed by task 1705:\n kasan_save_track+0x3e/0x80\n kasan_save_free_info+0x46/0x50\n __kasan_slab_free+0x62/0x70\n kfree+0x194/0x440\n evict+0x524/0x9f0\n do_unlinkat+0x390/0x5b0\n __x64_sys_unlink+0x47/0x50\n do_syscall_64+0xf6/0x210\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nThis \u0027stress-ng\u0027 workload causes the concurrent deletions from\n\u0027binder_devices\u0027 and so requires full-featured synchronization\nto prevent list corruption.\n\nI\u0027ve found this issue independently but pretty sure that syzbot did\nthe same, so Reported-by: and Closes: should be applicable here as well."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached only through local syscalls \u2014 mount(2)/umount(2) of binderfs, ioctl(BINDER_CTL_ADD) on binder-control, and unlink(2) of a binderfs device node. No network or remote component is involved.\nAC:L - The attacker drives both sides of the race himself with two threads (one adding devices via mount/BINDER_CTL_ADD, one removing them via unlink/umount) on a list protected by no lock whatsoever, so no attacker-uncontrolled condition is required. stress-ng --binderfs and syzkaller both reproduce it readily.\nPR:L - binderfs sets FS_USERNS_MOUNT and clears SB_I_NODEV, so any unprivileged local user can mount it inside `unshare -Urm` and becomes owner of the 0600 binder-control node, granting full access to the vulnerable add/remove paths. No real root or init-namespace capability is needed.\nUI:N - The attacker performs every step in his own processes; no victim action, no administrator-mounted filesystem, and no interaction with another user is required.\nS:U - The corruption is confined to kernel slab memory and is exploited by kernel code in the same security authority; there is no VM, IOMMU, or hypervisor boundary crossed, so this is standard local kernel privilege escalation.\nC:H - The unlocked list manipulation yields a slab use-after-free with dangling list pointers, and since hlist is at offset 0 of struct binder_device an attacker can reallocate the freed slot with a chosen victim object and leverage the corrupted pointers for kernel memory disclosure, up to full compromise of kernel confidentiality.\nI:H - __hlist_del() writes an 8-byte kernel pointer into already-freed memory at a controllable offset of a sprayable slab object, providing a write primitive suitable for control-flow hijacking and privilege escalation.\nA:H - The use-after-free and resulting list corruption reliably produce kernel oops/panic even in unsuccessful exploitation attempts, and any unprivileged user can trigger it repeatedly to crash the system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:00:07.428Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/80ed8ab8efa0d18c03968a2321154f10e2d1a2e3"
        },
        {
          "url": "https://git.kernel.org/stable/c/aea61a1a77613d4184d7ebe7c1d7cb606458b43b"
        },
        {
          "url": "https://git.kernel.org/stable/c/8c0a559825281764061a127632e5ad273f0466ad"
        }
      ],
      "title": "binder: fix use-after-free in binderfs_evict_inode()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38176",
    "datePublished": "2025-07-04T10:39:57.229Z",
    "dateReserved": "2025-04-16T04:51:23.992Z",
    "dateUpdated": "2026-08-05T12:00:07.428Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38176",
      "date": "2026-08-11",
      "epss": "0.00141",
      "percentile": "0.03922"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38176\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-04T11:15:51.543\",\"lastModified\":\"2026-07-30T06:22:57.393\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbinder: fix use-after-free in binderfs_evict_inode()\\n\\nRunning \u0027stress-ng --binderfs 16 --timeout 300\u0027 under KASAN-enabled\\nkernel, I\u0027ve noticed the following:\\n\\nBUG: KASAN: slab-use-after-free in binderfs_evict_inode+0x1de/0x2d0\\nWrite of size 8 at addr ffff88807379bc08 by task stress-ng-binde/1699\\n\\nCPU: 0 UID: 0 PID: 1699 Comm: stress-ng-binde Not tainted 6.14.0-rc7-g586de92313fc-dirty #13\\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014\\nCall Trace:\\n \u003cTASK\u003e\\n dump_stack_lvl+0x1c2/0x2a0\\n ? __pfx_dump_stack_lvl+0x10/0x10\\n ? __pfx__printk+0x10/0x10\\n ? __pfx_lock_release+0x10/0x10\\n ? __virt_addr_valid+0x18c/0x540\\n ? __virt_addr_valid+0x469/0x540\\n print_report+0x155/0x840\\n ? __virt_addr_valid+0x18c/0x540\\n ? __virt_addr_valid+0x469/0x540\\n ? __phys_addr+0xba/0x170\\n ? binderfs_evict_inode+0x1de/0x2d0\\n kasan_report+0x147/0x180\\n ? binderfs_evict_inode+0x1de/0x2d0\\n binderfs_evict_inode+0x1de/0x2d0\\n ? __pfx_binderfs_evict_inode+0x10/0x10\\n evict+0x524/0x9f0\\n ? __pfx_lock_release+0x10/0x10\\n ? __pfx_evict+0x10/0x10\\n ? do_raw_spin_unlock+0x4d/0x210\\n ? _raw_spin_unlock+0x28/0x50\\n ? iput+0x697/0x9b0\\n __dentry_kill+0x209/0x660\\n ? shrink_kill+0x8d/0x2c0\\n shrink_kill+0xa9/0x2c0\\n shrink_dentry_list+0x2e0/0x5e0\\n shrink_dcache_parent+0xa2/0x2c0\\n ? __pfx_shrink_dcache_parent+0x10/0x10\\n ? __pfx_lock_release+0x10/0x10\\n ? __pfx_do_raw_spin_lock+0x10/0x10\\n do_one_tree+0x23/0xe0\\n shrink_dcache_for_umount+0xa0/0x170\\n generic_shutdown_super+0x67/0x390\\n kill_litter_super+0x76/0xb0\\n binderfs_kill_super+0x44/0x90\\n deactivate_locked_super+0xb9/0x130\\n cleanup_mnt+0x422/0x4c0\\n ? lockdep_hardirqs_on+0x9d/0x150\\n task_work_run+0x1d2/0x260\\n ? __pfx_task_work_run+0x10/0x10\\n resume_user_mode_work+0x52/0x60\\n syscall_exit_to_user_mode+0x9a/0x120\\n do_syscall_64+0x103/0x210\\n ? asm_sysvec_apic_timer_interrupt+0x1a/0x20\\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\\nRIP: 0033:0xcac57b\\nCode: c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 f3 0f 1e fa 31 f6 e9 05 00 00 00 0f 1f 44 00 00 f3 0f 1e fa b8\\nRSP: 002b:00007ffecf4226a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6\\nRAX: 0000000000000000 RBX: 00007ffecf422720 RCX: 0000000000cac57b\\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007ffecf422850\\nRBP: 00007ffecf422850 R08: 0000000028d06ab1 R09: 7fffffffffffffff\\nR10: 3fffffffffffffff R11: 0000000000000246 R12: 00007ffecf422718\\nR13: 00007ffecf422710 R14: 00007f478f87b658 R15: 00007ffecf422830\\n \u003c/TASK\u003e\\n\\nAllocated by task 1705:\\n kasan_save_track+0x3e/0x80\\n __kasan_kmalloc+0x8f/0xa0\\n __kmalloc_cache_noprof+0x213/0x3e0\\n binderfs_binder_device_create+0x183/0xa80\\n binder_ctl_ioctl+0x138/0x190\\n __x64_sys_ioctl+0x120/0x1b0\\n do_syscall_64+0xf6/0x210\\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\\n\\nFreed by task 1705:\\n kasan_save_track+0x3e/0x80\\n kasan_save_free_info+0x46/0x50\\n __kasan_slab_free+0x62/0x70\\n kfree+0x194/0x440\\n evict+0x524/0x9f0\\n do_unlinkat+0x390/0x5b0\\n __x64_sys_unlink+0x47/0x50\\n do_syscall_64+0xf6/0x210\\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\\n\\nThis \u0027stress-ng\u0027 workload causes the concurrent deletions from\\n\u0027binder_devices\u0027 and so requires full-featured synchronization\\nto prevent list corruption.\\n\\nI\u0027ve found this issue independently but pretty sure that syzbot did\\nthe same, so Reported-by: and Closes: should be applicable here as well.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: binder: correcci\u00f3n de use-after-free en binderfs_evict_inode() Al ejecutar \u0027stress-ng --binderfs 16 --timeout 300\u0027 bajo un kernel habilitado para KASAN, he notado lo siguiente: ERROR: KASAN: slab-use-after-free in binderfs_evict_inode+0x1de/0x2d0 Write of size 8 at addr ffff88807379bc08 by task stress-ng-binde/1699 CPU: 0 UID: 0 PID: 1699 Comm: stress-ng-binde Not tainted 6.14.0-rc7-g586de92313fc-dirty #13 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014 Call Trace:  dump_stack_lvl+0x1c2/0x2a0 ? __pfx_dump_stack_lvl+0x10/0x10 ? __pfx__printk+0x10/0x10 ? __pfx_lock_release+0x10/0x10 ? __virt_addr_valid+0x18c/0x540 ? __virt_addr_valid+0x469/0x540 print_report+0x155/0x840 ? __virt_addr_valid+0x18c/0x540 ? __virt_addr_valid+0x469/0x540 ? __phys_addr+0xba/0x170 ? binderfs_evict_inode+0x1de/0x2d0 kasan_report+0x147/0x180 ? binderfs_evict_inode+0x1de/0x2d0 binderfs_evict_inode+0x1de/0x2d0 ? __pfx_binderfs_evict_inode+0x10/0x10 evict+0x524/0x9f0 ? __pfx_lock_release+0x10/0x10 ? __pfx_evict+0x10/0x10 ? do_raw_spin_unlock+0x4d/0x210 ? _raw_spin_unlock+0x28/0x50 ? iput+0x697/0x9b0 __dentry_kill+0x209/0x660 ? shrink_kill+0x8d/0x2c0 shrink_kill+0xa9/0x2c0 shrink_dentry_list+0x2e0/0x5e0 shrink_dcache_parent+0xa2/0x2c0 ? __pfx_shrink_dcache_parent+0x10/0x10 ? __pfx_lock_release+0x10/0x10 ? __pfx_do_raw_spin_lock+0x10/0x10 do_one_tree+0x23/0xe0 shrink_dcache_for_umount+0xa0/0x170 generic_shutdown_super+0x67/0x390 kill_litter_super+0x76/0xb0 binderfs_kill_super+0x44/0x90 deactivate_locked_super+0xb9/0x130 cleanup_mnt+0x422/0x4c0 ? lockdep_hardirqs_on+0x9d/0x150 task_work_run+0x1d2/0x260 ? __pfx_task_work_run+0x10/0x10 resume_user_mode_work+0x52/0x60 syscall_exit_to_user_mode+0x9a/0x120 do_syscall_64+0x103/0x210 ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0xcac57b Code: c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 f3 0f 1e fa 31 f6 e9 05 00 00 00 0f 1f 44 00 00 f3 0f 1e fa b8 RSP: 002b:00007ffecf4226a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 00007ffecf422720 RCX: 0000000000cac57b RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007ffecf422850 RBP: 00007ffecf422850 R08: 0000000028d06ab1 R09: 7fffffffffffffff R10: 3fffffffffffffff R11: 0000000000000246 R12: 00007ffecf422718 R13: 00007ffecf422710 R14: 00007f478f87b658 R15: 00007ffecf422830  Allocated by task 1705: kasan_save_track+0x3e/0x80 __kasan_kmalloc+0x8f/0xa0 __kmalloc_cache_noprof+0x213/0x3e0 binderfs_binder_device_create+0x183/0xa80 binder_ctl_ioctl+0x138/0x190 __x64_sys_ioctl+0x120/0x1b0 do_syscall_64+0xf6/0x210 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 1705: kasan_save_track+0x3e/0x80 kasan_save_free_info+0x46/0x50 __kasan_slab_free+0x62/0x70 kfree+0x194/0x440 evict+0x524/0x9f0 do_unlinkat+0x390/0x5b0 __x64_sys_unlink+0x47/0x50 do_syscall_64+0xf6/0x210 entry_SYSCALL_64_after_hwframe+0x77/0x7f Esta carga de trabajo \\\"stress-ng\\\" provoca eliminaciones simult\u00e1neas de \\\"binder_devices\\\" y, por lo tanto, requiere una sincronizaci\u00f3n completa para evitar la corrupci\u00f3n de listas. He encontrado este problema de forma independiente, pero estoy bastante seguro de que syzbot hizo lo mismo, por lo que \\\"Reportado por:\\\" y \\\"Cierra:\\\" tambi\u00e9n deber\u00edan aplicarse en este caso.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/android/binder.c\",\"drivers/android/binder_internal.h\",\"drivers/android/binderfs.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"e77aff5528a183462714f750e45add6cc71e276a\",\"lessThan\":\"80ed8ab8efa0d18c03968a2321154f10e2d1a2e3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e77aff5528a183462714f750e45add6cc71e276a\",\"lessThan\":\"aea61a1a77613d4184d7ebe7c1d7cb606458b43b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e77aff5528a183462714f750e45add6cc71e276a\",\"lessThan\":\"8c0a559825281764061a127632e5ad273f0466ad\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/android/binder.c\",\"drivers/android/binder_internal.h\",\"drivers/android/binderfs.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14.11\",\"lessThanOrEqual\":\"6.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15.2\",\"lessThanOrEqual\":\"6.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.14.1\",\"versionEndExcluding\":\"6.14.11\",\"matchCriteriaId\":\"D7BD802A-C2F1-4CA1-887A-5B3A2FA6D4E7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.15\",\"versionEndExcluding\":\"6.15.2\",\"matchCriteriaId\":\"5C28A2D1-4E5D-4F87-AEFA-9268B4CB0980\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"7DE421BA-0600-4401-A175-73CAB6A6FB4E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"1759FFB7-531C-41B1-9AE1-FD3D80E0D920\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"AD948719-8628-4421-A340-1066314BBD4A\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/80ed8ab8efa0d18c03968a2321154f10e2d1a2e3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8c0a559825281764061a127632e5ad273f0466ad\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/aea61a1a77613d4184d7ebe7c1d7cb606458b43b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:15:47+00:00",
      "cve": "CVE-2025-38176",
      "id": "CVE-2025-38176",
      "initial_release_date": "2025-07-04T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: binder: fix use-after-free in binderfs_evict_inode()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38176.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-05-13T04:12:30Z",
      "cve": "CVE-2025-38176",
      "id": "CVE-2025-38176",
      "initial_release_date": "2025-07-04T23:22:21Z",
      "product_status:known_not_affected": "345",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38176",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38176.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.