CVE-2025-71181: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-71181 is an improper locking vulnerability in the Linux kernel's Rust Binder (rust_binder) driver, specifically within the rust_shrink_free_page() function. The flaw was introduced during the forward-porting of Rust Binder to kernel version 6.18, where a necessary adaptation for commit fb56fdf8b9a2 ("mm/list_lru: split the lock to per-cgroup scope") was overlooked, causing a recursive spin lock acquisition that results in a kernel deadlock. Affected versions include Linux kernel 6.18 through 6.18.5 and 6.19-rc1 through 6.19-rc8. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-667 (Improper Locking). When the kernel's memory reclamation subsystem (kswapd) invokes the shrinker callback in rust_shrink_free_page(), the function attempts to acquire a spin lock (&l->lock) that is already held by the same execution context — a consequence of the per-cgroup LRU lock split introduced in a prior mm subsystem commit. This creates a classic recursive locking deadlock scenario detectable via the kernel's lockdep subsystem. The fix removes the redundant spin_lock() call from rust_shrink_free_page(), aligning the Rust Binder shrinker with the updated locking semantics of the mm/list_lru subsystem (Red Hat Bugzilla, Kernel Patch 1, Kernel Patch 2).

Successful triggering of this vulnerability causes a kernel deadlock during memory reclamation operations, resulting in a denial of service. When the system is under memory pressure and kswapd invokes the Rust Binder shrinker callback, the recursive lock acquisition halts normal memory management, potentially causing system hangs or complete unresponsiveness. There is no confidentiality or integrity impact; the vulnerability is limited to availability (Red Hat Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation. The vulnerability requires a local user with low privileges to trigger memory pressure conditions on a system running an affected kernel with the Rust Binder driver enabled. The EPSS score is approximately 0.018% (0.000180), reflecting very low exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Red Hat Advisory).

• Logs: Kernel log (dmesg / /var/log/kern.log) entries containing WARNING: possible recursive locking detected involving rust_helper_spin_lock and lock_list_lru_of_memcg.
• Logs: Kernel lockdep warnings referencing kswapd0 holding (&l->lock) and attempting to re-acquire the same lock, with a *** DEADLOCK *** annotation.
• Process: kswapd process appearing hung or unresponsive during periods of memory pressure on systems with Rust Binder enabled.
• System Behavior: System unresponsiveness or hard hang during high memory utilization on Linux 6.18.x kernels with Rust Binder compiled in.

Update to Linux kernel 6.18.6 or later (stable branch), or 6.19-rc5 or later (mainline), which include the fix removing the erroneous spin_lock() call from rust_shrink_free_page(). As a workaround, systems that do not require the Rust Binder driver can disable it at build time or via kernel module configuration to eliminate exposure. Prioritize patching on systems under frequent memory pressure where kswapd activity is high (Red Hat Advisory, Kernel Patch 1, Kernel Patch 2).