Linux Kernel EUVD-2026-28739

Requires local authenticated access with low privileges (PR:L) to a Linux system running kernel versions 6.18.0 through 6.18.18, 6.19.0 through 6.19.8, or 7.0-rc with rust_binder functionality enabled (CONFIG_RUST_BINDER). Critically, exploitation requires chaining with a separate vulnerability that allows the attacker to write to their own process's Binder transaction VMA despite it being mapped read-only - the vendor explicitly states this TOCTOU race is 'unexploitable without another Binder bug.' The attacker must also craft a transaction payload with specific structure to trigger exploitable behavior in the receiving process. Exploitation is limited to systems where rust_binder IPC is actively used between processes with different privilege levels, and the attacker must win a race condition between kernel operations. This combination of prerequisites significantly constrains real-world exploitability, explaining the low EPSS score despite straightforward CVSS metrics (AC:L).

Real-world risk is moderate despite high CVSS 7.8 score. The CVSS vector (AV:L/AC:L/PR:L/UI:N) indicates local access with low attack complexity and low privileges required, suggesting straightforward exploitation once prerequisites are met. However, the EPSS score of 0.02% (4th percentile) indicates very low probability of active exploitation in the wild. This disconnect stems from the critical prerequisite: attackers must first compromise the VMA read-only protection through a separate vulnerability before exploiting this TOCTOU race. The vulnerability is not listed in CISA KEV, confirming no observed active exploitation. No public POC is identified in available data. The primary risk scenario involves sophisticated attackers who have already achieved initial compromise and are chaining vulnerabilities for privilege escalation. The vendor describes this as 'unexploitable without another Binder bug,' positioning it as a hardening measure rather than an immediate critical threat. Priority should be moderate: patch during normal maintenance windows for systems using rust_binder (kernel 6.18+), but this is not an emergency requiring immediate out-of-band patching unless your threat model includes advanced persistent threats with kernel exploit chains.

An attacker with local authenticated access and low privileges on a Linux system running kernel 6.18-7.0 with rust_binder enabled first exploits a separate memory corruption vulnerability to gain write access to their process's supposedly read-only Binder transaction VMA. They then initiate a Binder transaction to a higher-privileged process while simultaneously modifying offset values in the shared VMA during the TOCTOU window between kernel write and read operations. By precisely timing the race and crafting a specific transaction payload structure, the attacker causes the kernel to misinterpret the transaction data, leading to memory corruption or arbitrary code execution in the context of the higher-privileged receiving process, achieving privilege escalation.