CVE-2025-40028
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-40028
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-40028.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2025-40028
- Downstream
- Published
- 2025-10-28T09:32:35.681Z
- Modified
- 2025-12-03T02:11:35.871289Z
- Summary
- binder: fix double-free in dbitmap
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
binder: fix double-free in dbitmap
A process might fail to allocate a new bitmap when trying to expand its proc->dmap. In that case, dbitmapgrow() fails and frees the old bitmap via dbitmapfree(). However, the driver calls dbitmap_free() again when the same process terminates, leading to a double-free error:
================================================================== BUG: KASAN: double-free in binderprocdec_tmpref+0x2e0/0x55c Free of addr ffff00000b7c1420 by task kworker/9:1/209
CPU: 9 UID: 0 PID: 209 Comm: kworker/9:1 Not tainted 6.17.0-rc6-dirty #5 PREEMPT Hardware name: linux,dummy-virt (DT) Workqueue: events binderdeferredfunc Call trace: kfree+0x164/0x31c binderprocdectmpref+0x2e0/0x55c binderdeferredfunc+0xc24/0x1120 processone_work+0x520/0xba4 [...]
Allocated by task 448: _kmallocnoprof+0x178/0x3c0 bitmapzalloc+0x24/0x30 binderopen+0x14c/0xc10 [...]
Freed by task 449: kfree+0x184/0x31c binderincreffornode+0xb44/0xe44 bindertransaction+0x29b4/0x7fbc binderthreadwrite+0x1708/0x442c binderioctl+0x1b50/0x2900 [...] ==================================================================
Fix this issue by marking proc->map NULL in dbitmap_free().
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40028.json" }- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/0390633979969c54c0ce6a198d6f45cdbe2c84b1
- https://git.kernel.org/stable/c/3ebcd3460cad351f198c39c6edb4af519a0ed934
- https://git.kernel.org/stable/c/b781e5635a3398e2b64440371233c2c5102cd6cb
- https://git.kernel.org/stable/c/c301ec61ce6f16e21a36b99225ca8a20c1591e10
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40028.json
- https://nvd.nist.gov/vuln/detail/CVE-2025-40028
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced15d9da3f818cae676f822a04407d3c17b53357d2Fixedc301ec61ce6f16e21a36b99225ca8a20c1591e10Fixed0390633979969c54c0ce6a198d6f45cdbe2c84b1Fixedb781e5635a3398e2b64440371233c2c5102cd6cbFixed3ebcd3460cad351f198c39c6edb4af519a0ed934