CVE-2026-43435 Linux CVE debrief

Who should care

Linux kernel maintainers, distro kernel teams, and operators of systems that ship or consume the rust_binder code path should care, especially where Binder transaction abuse resistance matters.

Technical summary

The vulnerability is a logic flaw in rust_binder’s oneway spam detection. In TreeRange, the detection code ran before the new request had been inserted, so the current request was not included in the spam calculation. In ArrayRange, the equivalent low_oneway_space() logic was missing entirely, creating a second path where large spamming transactions could bypass detection. The supplied kernel fix moves the TreeRange check after insertion and adds the missing ArrayRange logic to restore consistent enforcement.

Defensive priority

Medium priority. This is a control-bypass issue in kernel abuse-detection logic rather than a memory-safety flaw, but it can reduce the effectiveness of transaction throttling or spam prevention in affected deployments.

Recommended defensive actions

• Review whether your kernel build includes the rust_binder fixes referenced by the supplied kernel stable links.
• Track downstream vendor or distro advisories for backported patches covering CVE-2026-43435.
• Update to a kernel release that contains the corrected TreeRange insertion order and ArrayRange low_oneway_space() implementation.
• If you maintain a downstream kernel tree, verify the spam-detection paths in rust_binder against the upstream fix before releasing builds.
• Monitor for abnormal Binder transaction spam or rate-limiting anomalies while patch rollout is in progress.

Evidence notes

The CVE description states that TreeRange spam detection was executed before the current request was inserted, so the new request was not counted, and that ArrayRange was missing the detection logic altogether. The NVD record linked in the source item lists the vulnerability status as 'Undergoing Analysis' and provides three kernel.org stable references. No CVSS score or weakness data was supplied in the corpus.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.