CVE-2025-68260

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

rust_binder: fix race condition on death_list

Rust Binder contains the following unsafe operation:

// SAFETY: A `NodeDeath` is never inserted into the death list

// of any node other than its owner, so it is either in this

// death list or in no death list.

unsafe { node_inner.death_list.remove(self) };

This operation is unsafe because when touching the prev/next pointers of

a list element, we have to ensure that no other thread is also touching

them in parallel. If the node is present in the list that `remove` is

called on, then that is fine because we have exclusive access to that

list. If the node is not in any list, then it's also ok. But if it's

present in a different list that may be accessed in parallel, then that

may be a data race on the prev/next pointers.

And unfortunately that is exactly what is happening here. In

Node::release, we:

1. Take the lock.

2. Move all items to a local list on the stac

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References