CVE-2026-23400

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23400", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:46.012Z", "datePublished": "2026-03-29T12:55:50.660Z", "dateUpdated": "2026-05-11T22:06:10.668Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:06:10.668Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrust_binder: call set_notification_done() without proc lock\n\nConsider the following sequence of events on a death listener:\n1. The remote process dies and sends a BR_DEAD_BINDER message.\n2. The local process invokes the BC_CLEAR_DEATH_NOTIFICATION command.\n3. The local process then invokes the BC_DEAD_BINDER_DONE.\nThen, the kernel will reply to the BC_DEAD_BINDER_DONE command with a\nBR_CLEAR_DEATH_NOTIFICATION_DONE reply using push_work_if_looper().\n\nHowever, this can result in a deadlock if the current thread is not a\nlooper. This is because dead_binder_done() still holds the proc lock\nduring set_notification_done(), which called push_work_if_looper().\nNormally, push_work_if_looper() takes the thread lock, which is fine to\ntake under the proc lock. But if the current thread is not a looper,\nthen it falls back to delivering the reply to the process work queue,\nwhich involves taking the proc lock. Since the proc lock is already\nheld, this is a deadlock.\n\nFix this by releasing the proc lock during set_notification_done(). It\nwas not intentional that it was held during that function to begin with.\n\nI don't think this ever happens in Android because BC_DEAD_BINDER_DONE\nis only invoked in response to BR_DEAD_BINDER messages, and the kernel\nalways delivers BR_DEAD_BINDER to a looper. So there's no scenario where\nAndroid userspace will call BC_DEAD_BINDER_DONE on a non-looper thread."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/android/binder/process.rs"], "versions": [{"version": "eafedbc7c050c44744fbdf80bdf3315e860b7513", "lessThan": "dd109e3442817bc03ad1f3ffd541092f8c428141", "status": "affected", "versionType": "git"}, {"version": "eafedbc7c050c44744fbdf80bdf3315e860b7513", "lessThan": "3be72099067d2cd4a0e089696f19780f75b2b88a", "status": "affected", "versionType": "git"}, {"version": "eafedbc7c050c44744fbdf80bdf3315e860b7513", "lessThan": "2e303f0febb65a434040774b793ba8356698802b", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/android/binder/process.rs"], "versions": [{"version": "6.18", "status": "affected"}, {"version": "0", "lessThan": "6.18", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.19", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.9", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "6.18.19"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "6.19.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/dd109e3442817bc03ad1f3ffd541092f8c428141"}, {"url": "https://git.kernel.org/stable/c/3be72099067d2cd4a0e089696f19780f75b2b88a"}, {"url": "https://git.kernel.org/stable/c/2e303f0febb65a434040774b793ba8356698802b"}], "title": "rust_binder: call set_notification_done() without proc lock", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/android/binder/process.rs"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "dd109e3442817bc03ad1f3ffd541092f8c428141", "status": "affected", "version": "eafedbc7c050c44744fbdf80bdf3315e860b7513", "versionType": "git"}, {"lessThan": "3be72099067d2cd4a0e089696f19780f75b2b88a", "status": "affected", "version": "eafedbc7c050c44744fbdf80bdf3315e860b7513", "versionType": "git"}, {"lessThan": "2e303f0febb65a434040774b793ba8356698802b", "status": "affected", "version": "eafedbc7c050c44744fbdf80bdf3315e860b7513", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/android/binder/process.rs"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.18"}, {"lessThan": "6.18", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.19", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6F718F75-20D5-4D17-B698-1D1BD5FDE294", "versionEndExcluding": "6.18.19", "versionStartIncluding": "6.18.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E825E7C3-FEAC-4FD3-8A81-78D7387948C9", "versionEndExcluding": "6.19.9", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.18:-:*:*:*:*:*:*", "matchCriteriaId": "DCE57113-2223-4308-A0F2-5E6ECFBB3C23", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrust_binder: call set_notification_done() without proc lock\n\nConsider the following sequence of events on a death listener:\n1. The remote process dies and sends a BR_DEAD_BINDER message.\n2. The local process invokes the BC_CLEAR_DEATH_NOTIFICATION command.\n3. The local process then invokes the BC_DEAD_BINDER_DONE.\nThen, the kernel will reply to the BC_DEAD_BINDER_DONE command with a\nBR_CLEAR_DEATH_NOTIFICATION_DONE reply using push_work_if_looper().\n\nHowever, this can result in a deadlock if the current thread is not a\nlooper. This is because dead_binder_done() still holds the proc lock\nduring set_notification_done(), which called push_work_if_looper().\nNormally, push_work_if_looper() takes the thread lock, which is fine to\ntake under the proc lock. But if the current thread is not a looper,\nthen it falls back to delivering the reply to the process work queue,\nwhich involves taking the proc lock. Since the proc lock is already\nheld, this is a deadlock.\n\nFix this by releasing the proc lock during set_notification_done(). It\nwas not intentional that it was held during that function to begin with.\n\nI don't think this ever happens in Android because BC_DEAD_BINDER_DONE\nis only invoked in response to BR_DEAD_BINDER messages, and the kernel\nalways delivers BR_DEAD_BINDER to a looper. So there's no scenario where\nAndroid userspace will call BC_DEAD_BINDER_DONE on a non-looper thread."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nrust_binder: llamar a set_notification_done() sin el bloqueo de proc\n\nConsidere la siguiente secuencia de eventos en un oyente de muerte:\n1. El proceso remoto muere y env\u00eda un mensaje BR_DEAD_BINDER.\n2. El proceso local invoca el comando BC_CLEAR_DEATH_NOTIFICATION.\n3. El proceso local luego invoca el BC_DEAD_BINDER_DONE.\nEntonces, el kernel responder\u00e1 al comando BC_DEAD_BINDER_DONE con una\nrespuesta BR_CLEAR_DEATH_NOTIFICATION_DONE usando push_work_if_looper().\n\nSin embargo, esto puede resultar en un interbloqueo si el hilo actual no es un\nlooper. Esto se debe a que dead_binder_done() a\u00fan mantiene el bloqueo de proc\ndurante set_notification_done(), que llam\u00f3 a push_work_if_looper().\nNormalmente, push_work_if_looper() toma el bloqueo de hilo, lo cual est\u00e1 bien tomar\nbajo el bloqueo de proc. Pero si el hilo actual no es un looper,\nentonces recurre a entregar la respuesta a la cola de trabajo del proceso,\nlo que implica tomar el bloqueo de proc. Dado que el bloqueo de proc ya est\u00e1\nretenido, esto es un interbloqueo.\n\nSolucione esto liberando el bloqueo de proc durante set_notification_done(). No\nfue intencional que se mantuviera durante esa funci\u00f3n para empezar.\n\nNo creo que esto ocurra nunca en Android porque BC_DEAD_BINDER_DONE\nsolo se invoca en respuesta a mensajes BR_DEAD_BINDER, y el kernel\nsiempre entrega BR_DEAD_BINDER a un looper. As\u00ed que no hay ning\u00fan escenario donde\nel espacio de usuario de Android llame a BC_DEAD_BINDER_DONE en un hilo que no sea un looper."}], "id": "CVE-2026-23400", "lastModified": "2026-06-17T10:21:30.500", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-03-29T13:16:58.920", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2e303f0febb65a434040774b793ba8356698802b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3be72099067d2cd4a0e089696f19780f75b2b88a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/dd109e3442817bc03ad1f3ffd541092f8c428141"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-667"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: rust_binder: call set_notification_done() without proc lock", "id": "2452844", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452844"}, "csaw": false, "cwe": "CWE-833", "details": ["A flaw was found in the Linux kernel's rust_binder component. A local user could potentially trigger a deadlock condition. This occurs when the set_notification_done() function is called while the proc lock is already held and the current thread is not a 'looper' (a thread designed to handle specific kernel messages). This can lead to a system freeze, causing a Denial of Service (DoS)."], "name": "CVE-2026-23400", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-03-29T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23400\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23400\nhttps://lore.kernel.org/linux-cve-announce/2026032953-CVE-2026-23400-b75a@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[eafedbc7c050c44744fbdf80bdf3315e860b7513,dd109e3442817bc03ad1f3ffd541092f8c428141)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[eafedbc7c050c44744fbdf80bdf3315e860b7513,3be72099067d2cd4a0e089696f19780f75b2b88a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[eafedbc7c050c44744fbdf80bdf3315e860b7513,2e303f0febb65a434040774b793ba8356698802b)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.18"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.18)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.19,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.9,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0-rc4,*)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-28T16:53:38.617647+00:00", "value": {"mitigation_remediation": ["Apply the latest Linux kernel release that contains the binder deadlock fix.", "Enable binder subsystem debug logging to capture potential deadlock events.", "Monitor binder logs for deadlock indications and restart affected services if necessary."], "summary": {"action": "Patch Now", "impact": "Denial of Service via deadlock"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Linux kernel. No specific version restrictions are listed, so any kernel release that includes the rust_binder code guarded by this bug is potentially impacted. Users running contemporary Linux distributions that embed this kernel code should verify whether it has been patched.", "description_and_impact": "A concurrency flaw in the Linux kernel\u2019s binder subsystem triggers a deadlock when the set_notification_done() function is called while the proc lock is still held. If the current thread is not a looper, this causes the thread to attempt to acquire the already\u2011held proc lock, resulting in an indefinite block that can halt binder\u2011based communication.", "risk_and_exploitability": "The CVE record lists a CVSS base score of 5.5, indicating a medium\u2011severity local denial of service. The EPSS score is below 1\u202f%, suggesting low probability of exploitation at the present time. The vulnerability is not in the CISA KEV catalog. Attackers would need local kernel access to trigger the deadlock, such as by initiating or responding to binder death notifications. Exploitation would lead to a lock of the binder subsystem, potentially disrupting inter\u2011process communication."}}}}, "created": "2026-03-29T20:31:20.201572+00:00", "updated": "2026-04-28T17:00:13.447055+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}