CVE-2026-43433: Linux Kernel Privilege Escalation Bug

CVE-2026-43433 Overview

CVE-2026-43433 is a local privilege escalation vulnerability in the Linux kernel's rust_binder driver. The flaw is a time-of-check time-of-use (TOCTOU) condition [CWE-367] in the transaction offsets array handling. When sending a transaction, the offsets array is copied into the target process's virtual memory area (VMA) and then read back. If an attacker gains the ability to write to their own read-only VMA, they can modify the offset between the write and the read, causing the kernel to misinterpret the sender's intent.

Critical Impact
A successful exploit chained with another Binder bug could allow a local user to escalate privileges by causing the receiver to gain the sender's elevated context.

Affected Products

Linux kernel versions containing the rust_binder driver implementation
Distributions shipping kernels with Rust Binder support enabled
Android-derived systems leveraging the upstream Rust Binder driver

Discovery Timeline

2026-05-08 - CVE-2026-43433 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-43433

Vulnerability Analysis

The rust_binder driver is the Rust-based reimplementation of the Linux kernel Binder inter-process communication (IPC) mechanism. Binder transactions carry a payload and an offsets array that identifies the locations of embedded objects within the payload. The driver copies this offsets array into a read-only VMA of the target process before reading the values back to process the transaction.

The design assumption holds that a read-only VMA cannot be modified by the target process, so values written by the kernel will match values read back. The vulnerability removes this assumption as a defense-in-depth measure. If a separate Binder bug grants write access to a process's own read-only mapping, an attacker can race the kernel's read-back operation and substitute a different offset value.

Substituting offsets can cause the receiver to interpret the payload differently than the sender intended. With a crafted payload shape, this confusion can result in the receiver acquiring objects or file descriptors that grant the sender's privileges, enabling local privilege escalation.

Root Cause

The root cause is a TOCTOU read pattern in which the kernel reads back a value it just wrote to a userspace-accessible mapping rather than using the trusted in-kernel value. The fix removes the read-back, eliminating the race window even if another bug enables write access to the read-only VMA.

Attack Vector

Exploitation requires local code execution with low privileges and no user interaction. The attack vector is local (AV:L), and exploitation depends on chaining with a separate Binder vulnerability that grants write access to the target process's read-only Binder VMA. The vulnerability is not exploitable in isolation, but the kernel maintainers removed the unsafe pattern as a hardening measure.

The vulnerability mechanism is described in prose because no verified exploit code is available. See the kernel commits referenced below for the upstream fix.

Detection Methods for CVE-2026-43433

Indicators of Compromise

Unexpected privilege transitions in processes communicating via Binder IPC
Kernel logs referencing rust_binder transaction anomalies or unexpected object types
Processes acquiring file descriptors or capabilities that exceed their assigned context

Detection Strategies

Monitor kernel version inventory to identify hosts running unpatched rust_binder builds
Audit auditd records for unusual setuid, setgid, or capability changes following Binder IPC activity
Correlate Binder driver error messages with subsequent privilege escalation events on the same process tree

Monitoring Recommendations

Enable kernel audit logging for IPC subsystems and review for repeated transaction failures
Track loaded kernel module versions across the fleet and alert on systems missing the patched commits
Establish baselines for Binder transaction volume and flag processes generating anomalous transaction patterns

How to Mitigate CVE-2026-43433

Immediate Actions Required

Apply the upstream kernel patches that remove the TOCTOU read from rust_binder offsets handling
Inventory all Linux systems with rust_binder enabled and prioritize patching multi-tenant or untrusted-user hosts
Restrict local access on systems that cannot be patched immediately to reduce exposure to local attackers

Patch Information

The vulnerability is resolved by upstream commits 3672141c93b7, 4cb9e13fec0d, and e19afb53f772. Apply the latest stable kernel release from your distribution vendor that incorporates these fixes.

Workarounds

Disable the rust_binder driver on systems that do not require it by removing the kernel module or rebuilding without CONFIG_RUST_BINDER
Limit local user access on affected systems until patches are deployed
Apply Linux Security Module (LSM) policies such as SELinux or AppArmor to restrict which processes can interact with the Binder driver

bash

# Verify kernel version and patch status
uname -r
grep -i CONFIG_RUST_BINDER /boot/config-$(uname -r)

# Disable rust_binder module if not required
sudo rmmod rust_binder 2>/dev/null
echo "blacklist rust_binder" | sudo tee /etc/modprobe.d/blacklist-rust-binder.conf