Linux kernel Rust Binder FDA len0 OOB via skip==0
CVE-2026-23194 Published on February 14, 2026
rust_binder: correctly handle FDA objects of length zero
In the Linux kernel, the following vulnerability has been resolved:
rust_binder: correctly handle FDA objects of length zero
Fix a bug where an empty FDA (fd array) object with 0 fds would cause an
out-of-bounds error. The previous implementation used `skip == 0` to
mean "this is a pointer fixup", but 0 is also the correct skip length
for an empty FDA. If the FDA is at the end of the buffer, then this
results in an attempt to write 8-bytes out of bounds. This is caught and
results in an EINVAL error being returned to userspace.
The pattern of using `skip == 0` as a special value originates from the
C-implementation of Binder. As part of fixing this bug, this pattern is
replaced with a Rust enum.
I considered the alternate option of not pushing a fixup when the length
is zero, but I think it's cleaner to just get rid of the zero-is-special
stuff.
The root cause of this bug was diagnosed by Gemini CLI on first try. I
used the following prompt:
> There appears to be a bug in @drivers/android/binder/thread.rs where
> the Fixups oob bug is triggered with 316 304 316 324. This implies
> that we somehow ended up with a fixup where buffer A has a pointer to
> buffer B, but the pointer is located at an index in buffer A that is
> out of bounds. Please investigate the code to find the bug. You may
> compare with @drivers/android/binder.c that implements this correctly.
Products Associated with CVE-2026-23194
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-23194 are published in Linux Kernel:
Affected Versions
Linux:- Version eafedbc7c050c44744fbdf80bdf3315e860b7513 and below 598fe3ff32e43918ed8a062f55432b3d23e6340c is affected.
- Version eafedbc7c050c44744fbdf80bdf3315e860b7513 and below 8f589c9c3be539d6c2b393c82940c3783831082f is affected.
- Version 6.18 is affected.
- Before 6.18 is unaffected.
- Version 6.18.10, <= 6.18.* is unaffected.
- Version 6.19, <= * is unaffected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.