Time-of-check Time-of-use (TOCTOU) Race Condition in Linux kernel - CVE-2026-43433

Vulnerability details

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to a time-of-check time-of-use race condition in rust_binder transaction offsets array handling when sending a transaction and reading back offsets from the target process vma. A local user can modify the copied offsets before they are read back to escalate privileges.

Exploitation requires the target process to gain the ability to write to its own normally read-only binder vma and a payload with a specific shape.

Affected software

How to mitigate CVE-2026-43433

External References

• https://git.kernel.org/stable/c/3672141c93b7a0c0132bf5d5021a4b7f1d663aaa
• https://git.kernel.org/stable/c/4cb9e13fec0de7c942f5f927469beb8e48ddd20f
• https://git.kernel.org/stable/c/e19afb53f7723b3bd22224f2b0c7dcfa70bb973f

Related Security Bulletins

• Time-of-check Time-of-use (TOCTOU) Race Condition in Linux kernel android binder driver