CVE-2026-23400: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23400 is a deadlock vulnerability in the Linux kernel's rust_binder IPC subsystem, specifically in the death notification handler. When the BC_DEAD_BINDER_DONE command is invoked on a non-looper thread while the process lock (proc lock) is held, the kernel attempts to re-acquire the same lock during set_notification_done(), resulting in a deadlock that freezes binder IPC functionality. Affected Linux kernel versions include 6.18, 6.18.1 through 6.18.18, 6.19 through 6.19.8, and 7.0-rc1 through 7.0-rc7. The vulnerability was published on March 29, 2026, with patches available by April 24, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Github Advisory).

The root cause is improper locking (CWE-667) and a deadlock condition (CWE-833) in the dead_binder_done() function of the Linux kernel's Rust binder implementation. The specific sequence is: (1) a remote process dies and sends BR_DEAD_BINDER; (2) the local process issues BC_CLEAR_DEATH_NOTIFICATION; (3) the local process then issues BC_DEAD_BINDER_DONE. The kernel responds with BR_CLEAR_DEATH_NOTIFICATION_DONE via push_work_if_looper(), which normally acquires the thread lock (safe under the proc lock). However, if the calling thread is not a looper, push_work_if_looper() falls back to the process work queue, which requires acquiring the proc lock — already held by the same thread — causing a deadlock. The fix releases the proc lock before calling set_notification_done() (Red Hat Bugzilla, Github Advisory).

Successful exploitation allows a local attacker with low privileges to freeze the binder IPC subsystem, causing a denial of service for all processes relying on binder communication. There is no confidentiality or integrity impact — the vulnerability exclusively affects availability (CVSS A:H). In practice, this could render affected processes unresponsive and may require a system reboot to recover, though the vendor notes this scenario is unlikely to occur in standard Android environments since BC_DEAD_BINDER_DONE is normally only invoked on looper threads (Red Hat Advisory, Github Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (Red Hat Advisory). The vulnerability requires local access with low privileges, limiting the attack surface. The EPSS score is approximately 0.017% (2nd percentile), indicating a very low probability of exploitation in the near term (Github Advisory). The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Patches have been applied to stable kernel trees via commits 2e303f0febb65a434040774b793ba8356698802b, 3be72099067d2cd4a0e089696f19780f75b2b88a, and dd109e3442817bc03ad1f3ffd541092f8c428141. Users should update to Linux kernel version 6.18.19 or later, 6.19.9 or later, or the production release of 7.0. As a temporary measure, restricting local user access to systems running vulnerable kernel versions reduces exposure. Monitoring system logs for binder subsystem hangs or IPC failures may help detect potential exploitation attempts (Red Hat Advisory, Red Hat Bugzilla).