GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-38175 (GCVE-0-2025-38175)

Vulnerability from cvelistv5 – Published: 2025-07-04 10:39 – Updated: 2026-08-05 12:00
VLAI
Title
binder: fix yet another UAF in binder_devices
Summary
In the Linux kernel, the following vulnerability has been resolved: binder: fix yet another UAF in binder_devices Commit e77aff5528a18 ("binderfs: fix use-after-free in binder_devices") addressed a use-after-free where devices could be released without first being removed from the binder_devices list. However, there is a similar path in binder_free_proc() that was missed: ================================================================== BUG: KASAN: slab-use-after-free in binder_remove_device+0xd4/0x100 Write of size 8 at addr ffff0000c773b900 by task umount/467 CPU: 12 UID: 0 PID: 467 Comm: umount Not tainted 6.15.0-rc7-00138-g57483a362741 #9 PREEMPT Hardware name: linux,dummy-virt (DT) Call trace: binder_remove_device+0xd4/0x100 binderfs_evict_inode+0x230/0x2f0 evict+0x25c/0x5dc iput+0x304/0x480 dentry_unlink_inode+0x208/0x46c __dentry_kill+0x154/0x530 [...] Allocated by task 463: __kmalloc_cache_noprof+0x13c/0x324 binderfs_binder_device_create.isra.0+0x138/0xa60 binder_ctl_ioctl+0x1ac/0x230 [...] Freed by task 215: kfree+0x184/0x31c binder_proc_dec_tmpref+0x33c/0x4ac binder_deferred_func+0xc10/0x1108 process_one_work+0x520/0xba4 [...] ================================================================== Call binder_remove_device() within binder_free_proc() to ensure the device is removed from the binder_devices list before being kfreed.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 12d909cac1e1c4147cc3417fee804ee12fc6b984 , < 4a7694f499cae5b83412c5281bf2c961f34f2ed6 (git)
Affected: 12d909cac1e1c4147cc3417fee804ee12fc6b984 , < 72a726fb5f25fbb31d6060acfb671c1955831245 (git)
Affected: 12d909cac1e1c4147cc3417fee804ee12fc6b984 , < 9857af0fcff385c75433f2162c30c62eb912ef6d (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.14
Unaffected: 0 , < 6.14 (semver)
Unaffected: 6.14.11 , ≤ 6.14.* (semver)
Unaffected: 6.15.2 , ≤ 6.15.* (semver)
Unaffected: 6.16 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/android/binder.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4a7694f499cae5b83412c5281bf2c961f34f2ed6",
              "status": "affected",
              "version": "12d909cac1e1c4147cc3417fee804ee12fc6b984",
              "versionType": "git"
            },
            {
              "lessThan": "72a726fb5f25fbb31d6060acfb671c1955831245",
              "status": "affected",
              "version": "12d909cac1e1c4147cc3417fee804ee12fc6b984",
              "versionType": "git"
            },
            {
              "lessThan": "9857af0fcff385c75433f2162c30c62eb912ef6d",
              "status": "affected",
              "version": "12d909cac1e1c4147cc3417fee804ee12fc6b984",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/android/binder.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.11",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.2",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbinder: fix yet another UAF in binder_devices\n\nCommit e77aff5528a18 (\"binderfs: fix use-after-free in binder_devices\")\naddressed a use-after-free where devices could be released without first\nbeing removed from the binder_devices list. However, there is a similar\npath in binder_free_proc() that was missed:\n\n  ==================================================================\n  BUG: KASAN: slab-use-after-free in binder_remove_device+0xd4/0x100\n  Write of size 8 at addr ffff0000c773b900 by task umount/467\n  CPU: 12 UID: 0 PID: 467 Comm: umount Not tainted 6.15.0-rc7-00138-g57483a362741 #9 PREEMPT\n  Hardware name: linux,dummy-virt (DT)\n  Call trace:\n   binder_remove_device+0xd4/0x100\n   binderfs_evict_inode+0x230/0x2f0\n   evict+0x25c/0x5dc\n   iput+0x304/0x480\n   dentry_unlink_inode+0x208/0x46c\n   __dentry_kill+0x154/0x530\n   [...]\n\n  Allocated by task 463:\n   __kmalloc_cache_noprof+0x13c/0x324\n   binderfs_binder_device_create.isra.0+0x138/0xa60\n   binder_ctl_ioctl+0x1ac/0x230\n  [...]\n\n  Freed by task 215:\n   kfree+0x184/0x31c\n   binder_proc_dec_tmpref+0x33c/0x4ac\n   binder_deferred_func+0xc10/0x1108\n   process_one_work+0x520/0xba4\n  [...]\n  ==================================================================\n\nCall binder_remove_device() within binder_free_proc() to ensure the\ndevice is removed from the binder_devices list before being kfreed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached through local operations only \u2014 mounting binderfs, the BINDER_CTL_ADD ioctl, opening binder device files, and process teardown. There is no network component.\nAC:L - The attacker fully controls both sides of the lifetime ordering (proc references via open/close and inode eviction via umount), and the bug is reliably reproducible (syzbot Tested-by), so no condition is beyond attacker control.\nPR:L - binderfs is an FS_USERNS_MOUNT filesystem, so an unprivileged user can mount it in a user namespace and drive the binder-control ioctl and device opens without real privileges; on Android, ordinary apps have binder access directly.\nUI:N - The attacker performs all steps (create device, open, trigger release and eviction) entirely on their own; no action from any other user is required.\nS:U - The use-after-free is contained within the kernel\u0027s own memory and security authority; it does not cross into a separate security scope such as a VM host or IOMMU boundary.\nC:H - A use-after-free on a re-allocatable heap object lets the attacker place controlled data in the freed slot and read back kernel memory contents, enabling information disclosure.\nI:H - The freed binder_device is written through hlist_del_init after reallocation, giving a write primitive on attacker-controlled heap contents that can be leveraged for further memory corruption and control-flow hijacking.\nA:H - The use-after-free corrupts kernel heap state and reliably triggers a KASAN-detected slab-use-after-free / oops, crashing the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:00:06.352Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4a7694f499cae5b83412c5281bf2c961f34f2ed6"
        },
        {
          "url": "https://git.kernel.org/stable/c/72a726fb5f25fbb31d6060acfb671c1955831245"
        },
        {
          "url": "https://git.kernel.org/stable/c/9857af0fcff385c75433f2162c30c62eb912ef6d"
        }
      ],
      "title": "binder: fix yet another UAF in binder_devices",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38175",
    "datePublished": "2025-07-04T10:39:56.392Z",
    "dateReserved": "2025-04-16T04:51:23.992Z",
    "dateUpdated": "2026-08-05T12:00:06.352Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38175",
      "date": "2026-09-15",
      "epss": "0.00147",
      "percentile": "0.04291"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38175\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-04T11:15:51.420\",\"lastModified\":\"2026-07-30T06:22:57.267\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbinder: fix yet another UAF in binder_devices\\n\\nCommit e77aff5528a18 (\\\"binderfs: fix use-after-free in binder_devices\\\")\\naddressed a use-after-free where devices could be released without first\\nbeing removed from the binder_devices list. However, there is a similar\\npath in binder_free_proc() that was missed:\\n\\n  ==================================================================\\n  BUG: KASAN: slab-use-after-free in binder_remove_device+0xd4/0x100\\n  Write of size 8 at addr ffff0000c773b900 by task umount/467\\n  CPU: 12 UID: 0 PID: 467 Comm: umount Not tainted 6.15.0-rc7-00138-g57483a362741 #9 PREEMPT\\n  Hardware name: linux,dummy-virt (DT)\\n  Call trace:\\n   binder_remove_device+0xd4/0x100\\n   binderfs_evict_inode+0x230/0x2f0\\n   evict+0x25c/0x5dc\\n   iput+0x304/0x480\\n   dentry_unlink_inode+0x208/0x46c\\n   __dentry_kill+0x154/0x530\\n   [...]\\n\\n  Allocated by task 463:\\n   __kmalloc_cache_noprof+0x13c/0x324\\n   binderfs_binder_device_create.isra.0+0x138/0xa60\\n   binder_ctl_ioctl+0x1ac/0x230\\n  [...]\\n\\n  Freed by task 215:\\n   kfree+0x184/0x31c\\n   binder_proc_dec_tmpref+0x33c/0x4ac\\n   binder_deferred_func+0xc10/0x1108\\n   process_one_work+0x520/0xba4\\n  [...]\\n  ==================================================================\\n\\nCall binder_remove_device() within binder_free_proc() to ensure the\\ndevice is removed from the binder_devices list before being kfreed.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: binder: corrige otro UAF en binder_devices El commit e77aff5528a18 (\\\"binderfs: corrige uuse-after-free en binder_devices\\\") abord\u00f3 un use-after-free donde los dispositivos pod\u00edan liberarse sin eliminarse primero de la lista binder_devices. Sin embargo, hay una ruta similar en binder_free_proc() que se omiti\u00f3: ====================================================================== ERROR: KASAN: slab-use-after-free in binder_remove_device+0xd4/0x100 Write of size 8 at addr ffff0000c773b900 by task umount/467 CPU: 12 UID: 0 PID: 467 Comm: umount Not tainted 6.15.0-rc7-00138-g57483a362741 #9 PREEMPT Hardware name: linux,dummy-virt (DT) Call trace: binder_remove_device+0xd4/0x100 binderfs_evict_inode+0x230/0x2f0 evict+0x25c/0x5dc iput+0x304/0x480 dentry_unlink_inode+0x208/0x46c __dentry_kill+0x154/0x530 [...] Allocated by task 463: __kmalloc_cache_noprof+0x13c/0x324 binderfs_binder_device_create.isra.0+0x138/0xa60 binder_ctl_ioctl+0x1ac/0x230 [...] Freed by task 215: kfree+0x184/0x31c binder_proc_dec_tmpref+0x33c/0x4ac binder_deferred_func+0xc10/0x1108 process_one_work+0x520/0xba4 [...] ====================================================================== Llame a binder_remove_device() dentro de binder_free_proc() para asegurarse de que el dispositivo se elimine de la lista binder_devices antes de ser liberado.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/android/binder.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"12d909cac1e1c4147cc3417fee804ee12fc6b984\",\"lessThan\":\"4a7694f499cae5b83412c5281bf2c961f34f2ed6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"12d909cac1e1c4147cc3417fee804ee12fc6b984\",\"lessThan\":\"72a726fb5f25fbb31d6060acfb671c1955831245\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"12d909cac1e1c4147cc3417fee804ee12fc6b984\",\"lessThan\":\"9857af0fcff385c75433f2162c30c62eb912ef6d\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/android/binder.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14.11\",\"lessThanOrEqual\":\"6.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15.2\",\"lessThanOrEqual\":\"6.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.14\",\"versionEndExcluding\":\"6.14.11\",\"matchCriteriaId\":\"490796E9-2E2D-45F9-84D0-6DCC48C4BB7F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.15\",\"versionEndExcluding\":\"6.15.2\",\"matchCriteriaId\":\"5C28A2D1-4E5D-4F87-AEFA-9268B4CB0980\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4a7694f499cae5b83412c5281bf2c961f34f2ed6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/72a726fb5f25fbb31d6060acfb671c1955831245\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9857af0fcff385c75433f2162c30c62eb912ef6d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:24:27+00:00",
      "cve": "CVE-2025-38175",
      "id": "CVE-2025-38175",
      "initial_release_date": "2025-07-04T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: binder: fix yet another UAF in binder_devices",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38175.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T02:01:39Z",
      "cve": "CVE-2025-38175",
      "id": "CVE-2025-38175",
      "initial_release_date": "2025-07-04T23:22:22Z",
      "product_status:known_not_affected": "524",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38175",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38175.json",
      "version": "7"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.