CVE-2026-23194: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-23194 is an out-of-bounds write vulnerability in the Linux kernel's rust_binder (Rust implementation of the Android Binder IPC driver) caused by incorrect handling of empty FDA (file descriptor array) objects with zero file descriptors. The flaw was published on February 14, 2026, and affects Linux kernel versions 6.18 through 6.18.9 and 6.19-rc1 through 6.19-rc8. It carries a CVSS v3.1 base score of 7.8 (High), exploitable locally by a low-privileged user (Feedly).

The root cause (CWE-787: Out-of-bounds Write) lies in the rust_binder driver's fixup processing logic in drivers/android/binder/thread.rs. The code previously used skip == 0 as a sentinel value to indicate a pointer fixup operation, but 0 is also the legitimate skip length for an empty FDA object. When an empty FDA is positioned at the end of a Binder transaction buffer, the driver attempts to write 8 bytes beyond the buffer boundary, triggering an out-of-bounds write that is caught and returned to userspace as an EINVAL error. The fix replaces the ambiguous zero-sentinel pattern with a Rust enum to cleanly distinguish between pointer fixups and FDA fixups. Notably, the root cause was diagnosed using Gemini CLI (Feedly, Kernel Patch 1).

A local attacker with low privileges who can interact with the Android Binder subsystem could trigger the out-of-bounds write in kernel memory, potentially leading to information disclosure, memory integrity violations, or denial of service. In the observed behavior, the kernel catches the write and returns EINVAL to userspace, limiting immediate impact; however, depending on kernel configuration and memory layout, more severe memory corruption outcomes cannot be ruled out. The vulnerability does not affect systems that do not use the rust_binder driver (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term (Feedly).

Upgrade to Linux kernel version 6.18.10 or later to receive the fix for the 6.18.x stable series. For systems running 6.19 release candidates, apply the stable git patches at commits 598fe3ff32e43918ed8a062f55432b3d23e6340c or 8f589c9c3be539d6c2b393c82940c3783831082f. As a temporary workaround, restricting unprivileged access to Binder IPC operations (e.g., via SELinux/AppArmor policies) can reduce exposure. Systems not using the rust_binder driver are not affected (Feedly, Kernel Patch 1, Kernel Patch 2).

Coverage has been limited to automated vulnerability tracking platforms and a brief technical write-up. A post on infinitsec.net summarized the bug and fix shortly after disclosure. Tenable's Nessus scanner (plugin 299100) added detection for this vulnerability. No notable vendor statements or significant researcher commentary beyond the kernel commit message have been observed (Feedly, Tenable).