# i didn't expect to see this...

Source: https://www.youtube.com/watch?v=dgPI7NfKCiQ
Recap page: https://rapidrecap.app/video/dgPI7NfKCiQ
Generated: 2025-12-17T17:40:28.007+00:00

---
## Quick Overview

The first ever CVE vulnerability assigned to Rust code within the Linux kernel, specifically CVE-2025-88260, was a race condition in the Rust Binder driver caused by an unsafe removal operation that occurred when a node was removed from the kernel's death list, leading to memory corruption and potential system crashes.

**Key Points:**
- The first CVE assigned to Rust code in the Linux kernel is CVE-2025-88260, originating in the Android Binder module.
- The vulnerability is a race condition in the Rust Binder implementation, specifically within the `node_inner::death_list::remove(self)` operation.
- The issue arises because the unsafe removal logic fails to ensure that no other thread is touching the node's prev/next pointers in parallel during removal.
- The unsafe operation is complicated by the fact that the Rust code assumes exclusive access to the list element, which is violated in multithreaded scenarios.
- The fix involved modifying the release logic to use `core::mem::take` and iterate over a local copy of the death list on the stack, ensuring exclusive lock management during removal.
- The race condition allows two threads to access and modify the same list pointers concurrently, leading to memory corruption and kernel panics (crashes) as seen in the provided crash dump.

![Screenshot at 00:42: A kernel mailing list email shows the description of the resolved vulnerability: "rust\_binder: fix race condition on death\_list", detailing the unsafe operation that led to the crash.](https://ss.rapidrecap.app/screens/dgPI7NfKCiQ/00-00-42.png)

**Context:** The video discusses the assignment of the first Common Vulnerabilities and Exposures (CVE) identifier to code written in the Rust programming language integrated into the Linux kernel. The specific vulnerability, tracked as CVE-2025-88260, was found in the Rust implementation of the Android Binder driver, which handles Inter-Process Communication (IPC) within the Android ecosystem. The speaker details the technical nature of the vulnerability, which revolves around improper lock management during concurrent list operations.

## Detailed Analysis

The video reports on the first Linux Kernel CVE assigned to Rust code: CVE-2025-88260, affecting the Rust Binder driver and stemming from a race condition in handling the death list. The unsafe operation, `node_inner::death_list::remove(self)`, violates safety guarantees because it assumes exclusive access while interacting with the `prev`/`next` pointers of a list element, which is unsafe when multiple threads might be accessing the list in parallel, especially during concurrent removals. The original logic failed to account for this parallelism, leading to memory corruption and kernel crashes, evidenced by a kernel panic dump shown on screen that mentions an address between user and kernel space ranges. The fix, described in the patch diff, modifies the release mechanism to acquire a lock, move all items from the death list to a temporary local list on the stack, drop the lock, iterate over the local stack copy, and then re-acquire the lock only when setting the node as dead (`set_dead`). This approach ensures that only one thread modifies the original list structure at a time, preventing the race condition.

### CVE Details

- CVE-2025-88260
- Rust Binder race condition on death_list
- Vulnerability confirmed by Greg Kroah-Hartman and others
- Fix available via patch mgxld.link/20251111-binder-fix-list-remove-v1-v1-8ed14a0d3c8e0d4a

### The Unsafe Operation

- `unsafe { node_inner::death_list::remove(self) }`
- Unsafe because touching prev/next pointers requires ensuring no other thread touches them in parallel
- Original code assumed exclusive access when removing a node from the death list.

### The Race Condition

- Two threads can access two different copies of the list concurrently, both believing they have exclusive access and performing updates, leading to memory corruption (e.g., invalid pointer values in `prev`/`next`).

### The Crash Evidence

- Kernel panic details shown, including an error address (`0xbbbb9841bcac70e`) marked as an 'Address between user and kernel address ranges' and a subsequent kernel crash.

### The Fix Strategy

- Modify `release` to take the lock, move all items to a local list on the stack, drop the lock, iterate the local list, and then re-lock. This prevents concurrent modification of the original list structure.

### Patch Diff Analysis

- The diff shows the removal of the old loop structure and replacement with a structure that uses `core::mem::take` and iterates over a stack-allocated local copy, ensuring atomic updates relative to the lock.

![Screenshot at 00:01: The presenter begins discussing the Phoronix article detailing the first Linux Kernel CVE found in Rust code.](https://ss.rapidrecap.app/screens/dgPI7NfKCiQ/00-00-01.png)
![Screenshot at 00:21: A diagram illustrating the Android Binder IPC mechanism, showing communication flow between User Space \(App\) and Kernel Space \(Binder Driver\).](https://ss.rapidrecap.app/screens/dgPI7NfKCiQ/00-00-21.png)
![Screenshot at 00:42: The kernel mailing list announcement for CVE-2025-88260, specifically noting the 'rust\_binder: fix race condition on death\_list'.](https://ss.rapidrecap.app/screens/dgPI7NfKCiQ/00-00-42.png)
![Screenshot at 01:33: A diagram showing a generic doubly linked list structure with nodes A, B, C, and D, used to illustrate pointer manipulation.](https://ss.rapidrecap.app/screens/dgPI7NfKCiQ/00-01-33.png)
![Screenshot at 07:00: A diff view showing the code change in drivers/android/binder/node.rs, highlighting the removal of the unsafe iteration and the introduction of the safe local copy manipulation using core::mem::take.](https://ss.rapidrecap.app/screens/dgPI7NfKCiQ/00-07-00.png)