Skip to main content

Linux Kernel CVE-2025-40028

HIGH
2025-10-28 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Local binder access (PR:L, AV:L); AC:H because the double-free requires forcing an allocation failure in dbitmap_grow rather than a deterministic trigger; full kernel heap corruption yields high C/I/A.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
6.1 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 07:56 vuln.today
CVE Published
Oct 28, 2025 - 10:15 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

binder: fix double-free in dbitmap

A process might fail to allocate a new bitmap when trying to expand its proc->dmap. In that case, dbitmap_grow() fails and frees the old bitmap via dbitmap_free(). However, the driver calls dbitmap_free() again when the same process terminates, leading to a double-free error:

============== BUG: KASAN: double-free in binder_proc_dec_tmpref+0x2e0/0x55c Free of addr ffff00000b7c1420 by task kworker/9:1/209

CPU: 9 UID: 0 PID: 209 Comm: kworker/9:1 Not tainted 6.17.0-rc6-dirty #5 PREEMPT Hardware name: linux,dummy-virt (DT) Workqueue: events binder_deferred_func Call trace: kfree+0x164/0x31c binder_proc_dec_tmpref+0x2e0/0x55c binder_deferred_func+0xc24/0x1120 process_one_work+0x520/0xba4 [...]

Allocated by task 448: __kmalloc_noprof+0x178/0x3c0 bitmap_zalloc+0x24/0x30 binder_open+0x14c/0xc10 [...]

Freed by task 449: kfree+0x184/0x31c binder_inc_ref_for_node+0xb44/0xe44 binder_transaction+0x29b4/0x7fbc binder_thread_write+0x1708/0x442c binder_ioctl+0x1b50/0x2900 [...] ==============

Fix this issue by marking proc->map NULL in dbitmap_free().

AnalysisAI

Local privilege escalation and memory corruption in the Linux kernel's Android binder IPC driver arises from a double-free in the dynamic bitmap (dbitmap) allocator used for per-process reference tracking. When a process's dmap expansion fails, dbitmap_grow() frees the old bitmap, but the pointer is not cleared, so binder_proc_dec_tmpref() frees it a second time at process teardown, corrupting the kernel heap. This is a memory-safety flaw exploitable by any local user with binder access (default on Android and many Linux systems); there is no public exploit identified at time of analysis and the EPSS score is low (0.19%).

Technical ContextAI

The affected component is the binder driver (drivers/android/), the core inter-process communication mechanism used pervasively on Android and available in mainline Linux. Binder tracks node references per process using a bitmap ('proc->dmap') that grows on demand via dbitmap_grow(); on a failed allocation during growth, the old bitmap is freed by dbitmap_free(). The root cause is a classic CWE-415 (Double Free): dbitmap_free() releases the memory but leaves proc->map pointing at the freed allocation, so the same pointer is passed to kfree() again during binder_proc_dec_tmpref() when the process terminates. The KASAN trace confirms the freed object (allocated in binder_open via bitmap_zalloc) is released once in binder_inc_ref_for_node()'s growth path and again during deferred process cleanup. The fix sets proc->map = NULL in dbitmap_free() so the stale pointer cannot be freed twice. Note the vendor CWE is listed as N/A, but the behavior is unambiguously a double-free.

Affected ProductsAI

The Linux kernel binder driver is affected; the reproducer was observed on kernel 6.17.0-rc6 and the bug exists in versions carrying the vulnerable dbitmap implementation prior to the fix. The four referenced git.kernel.org commits (0390633979969c54c0ce6a198d6f45cdbe2c84b1, 3ebcd3460cad351f198c39c6edb4af519a0ed934, b781e5635a3398e2b64440371233c2c5102cd6cb, c301ec61ce6f16e21a36b99225ca8a20c1591e10) represent the fix landing across mainline and stable branches. No CPE strings were provided in the input, so exact version ranges per stable series are not enumerated here; consult the linked stable commits and your distribution's advisory to confirm which longterm kernels (and Android common kernels) ship the vulnerable code. Practically, any system running an unpatched binder-enabled kernel - Android devices and Linux hosts using binder - should be considered in scope.

RemediationAI

Upstream fix available (multiple git.kernel.org stable commits); a released, tagged patched kernel version is not independently identified in the provided data - apply the stable-tree update from your distribution or Android security bulletin that incorporates commits 0390633979969c54c0ce6a198d6f45cdbe2c84b1 / 3ebcd3460cad351f198c39c6edb4af519a0ed934 / b781e5635a3398e2b64440371233c2c5102cd6cb / c301ec61ce6f16e21a36b99225ca8a20c1591e10 (the change simply marks proc->map NULL in dbitmap_free()). Rebuild or update to a kernel that includes these commits and reboot. Where immediate patching is not possible and binder is not required (typical of non-Android Linux servers), disabling or not loading the binder driver (CONFIG_ANDROID_BINDER_IPC / unloading binder_linux) removes the attack surface entirely at the cost of breaking any Android-container or binder-dependent workloads; on Android this is not a viable workaround since binder is core to the OS. There is no configuration-level mitigation that neutralizes the bug while keeping binder enabled, so restricting local/untrusted code execution on affected hosts is the main compensating control until patched.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected

Share

CVE-2025-40028 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy