A concurrency flaw in the Linux kernel’s binder subsystem triggers a deadlock when the set_notification_done() function is called while the proc lock is still held. If the current thread is not a looper, this causes the thread to attempt to acquire the already‑held proc lock, resulting in an indefinite block that can halt binder‑based communication.

The vulnerability affects the Linux kernel. No specific version restrictions are listed, so any kernel release that includes the rust_binder code guarded by this bug is potentially impacted. Users running contemporary Linux distributions that embed this kernel code should verify whether it has been patched.

The CVE record lists a CVSS base score of 5.5, indicating a medium‑severity local denial of service. The EPSS score is below 1 %, suggesting low probability of exploitation at the present time. The vulnerability is not in the CISA KEV catalog. Attackers would need local kernel access to trigger the deadlock, such as by initiating or responding to binder death notifications. Exploitation would lead to a lock of the binder subsystem, potentially disrupting inter‑process communication.