A flaw in the Linux kernel’s Rust Binder subsystem allows an attacker to cause pages to be installed into a different virtual memory area when the original VMA is closed and a new one is mapped at the same address. This omission enables writing to pages that are normally read‑only, effectively giving an arbitrary kernel‑space write. Such a fault can be leveraged to modify critical kernel data structures and gain elevated privileges, making this a privilege‑escalation vulnerability.

All kernel builds that include the unpatched Rust Binder implementation are affected. The CNA data lists only the Linux kernel as the product, and no specific version ranges are provided, so any Linux installation running a kernel prior to the patch is susceptible until the fix is applied or the kernel is updated.

Formal severity metrics are not available; the EPSS score is reported as less than 1%, indicating a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, suggesting no documented active exploitation. Exploitation is likely local, requiring the attacker to be able to invoke a Binder operation from user space or to load a kernel module that triggers the vulnerable code path. Remote exploitation would require a prior foothold that grants code execution in the kernel context.