Rust’s First Breach: CVE-2025-68260 Marks the First Rust Vulnerability in the Linux Kernel

CVE-2025-68260 has been fixed in the Linux kernel, marking the first Rust code vulnerability formally assigned to the mainline kernel, according to the article. Greg Kroah-Hartman reported the issue, which affects the Android Binder driver rewritten in Rust and could, in the worst case, cause system crashes.

The fault stems from a race condition in Node::release where an element is removed from a list while another thread may concurrently manipulate the same prev/next pointers, potentially corrupting memory and triggering a kernel crash. The fix rewrites Node::release to extract elements directly from the original list, removing the intermediate stack-based list.

According to the Linux kernel CVE team, the issue was introduced in Linux 6.18 (commit eafedbc7c050c44744fbdf80bdf3315e860b7513) and resolved in 6.18.1 and in 6.19-rc1, with the affected file being drivers/android/binder/node[.]rs; upgrading to a current stable kernel release is strongly recommended.