Linux Kernel Rust Code Sees Its First CVE Vulnerability

Summary

The first CVE vulnerability has been assigned to a piece of the Linux kernel's Rust code. Greg Kroah-Hartman announced that the first CVE has been assigned to a piece of Rust code within the mainline Linux kernel. This first CVE for Rust code in the Linux kernel pertains to the Android Binder rewrite in Rust. There is a race condition that can occur due to some noted unsafe Rust code. That code can lead to memory corruption of the previous/next pointers and in turn cause a crash. This CVE for the possible system crash is for Linux 6.18 and newer since the introduction of the Rust Binder driver. At least though it's just a possible system crash and not any more serious system compromise with remote code execution or other more severe issues. More details on CVE-2025-68260 via the Linux CVE mailing list.