Loading story…
The Linux kernel has received its first CVE for a vulnerability in code written in the Rust programming language, identified as CVE-2025-68260. This flaw is associated with the Android Binder driver, which was rewritten in Rust and introduced in Linux kernel version 6.18 and later. The vulnerability stems from a race condition in unsafe Rust code, which can result in memory corruption of linked list pointers and potentially cause a system crash.
Security researchers and kernel maintainers have noted that, while this is a significant milestone for Rust in the Linux kernel, the impact of the vulnerability is currently limited to possible system crashes rather than more severe outcomes such as remote code execution or privilege escalation. The issue highlights the importance of careful handling of unsafe code even in memory-safe languages like Rust, especially as its adoption in critical system components increases.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
A vulnerability tracked as CVE-2025-68260 was identified in Rust code used in the Linux kernel, marking the first reported CVE affecting the kernel's Rust components. The disclosure highlighted that Rust integration can still introduce security issues despite its memory-safety goals.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google has reported a significant reduction in memory safety vulnerabilities in Android, attributing this improvement to the adoption of the Rust programming language. According to Google, the proportion of memory safety bugs in Android has dropped below 20% for the first time, with Rust code demonstrating a 1000x reduction in vulnerability density compared to C and C++. The transition to Rust has also led to operational benefits, such as a lower rollback rate and faster code review cycles, and Google plans to expand Rust's use to additional components of the Android ecosystem, including the kernel, firmware, and key applications. Security experts emphasize that secure coding should focus on principles like secure by default and secure by design, rather than simply identifying vulnerabilities. The integration of Rust into Android's codebase exemplifies how adopting memory-safe languages can serve as a practical application of these secure coding principles, reducing the burden on developers and improving overall software security. Google's experience also highlights the importance of a defense-in-depth approach, as even memory-safe languages like Rust can have vulnerabilities if unsafe code is used, as demonstrated by the discovery and patching of a buffer overflow in the CrabbyAVIF parser before public release.
Jun 29, 2026
Researchers disclosed two separate Linux kernel privilege-escalation flaws that can give local attackers **root** access across a wide range of systems, including servers, desktops, and Android devices. One bug, **`CVE-2026-46242`** or **Bad Epoll**, is a use-after-free race in the kernel's `epoll` subsystem that was reportedly exploited through Google's kernelCTF program and shown to be broadly reachable because `epoll` is a core component that cannot be disabled. The flaw was introduced by a 2023 kernel change, and reporting said an initial patch attempt was insufficient before a correct fix was merged weeks later, leaving defenders dependent on upstream fixes and vendor backports. A second flaw, **`CVE-2026-43456`**, affects the kernel's `net/bonding` subsystem and stems from a type-confusion condition dating back to 2007. Researchers said the bug can be exploited with high reliability for local root by abusing incompatible `header_ops` handling in bonded network devices, enabling controlled memory corruption and eventual code execution. The issue reportedly affects Linux versions **2.6.24 through 6.12.77** and requires **`CAP_NET_ADMIN`** privileges; mitigations include applying the March 2026 patch, or temporarily disabling unprivileged user namespaces or the bonding module where feasible.
Aug 25, 2026
**CVE-2024-26880** is a moderate-severity Linux kernel flaw in the device-mapper subsystem, specifically `drivers/md/dm.c`, that can corrupt an internal list and trigger a kernel BUG or system crash in the `dm_snapshot` path. During an internal suspend, device-mapper failed to invoke the target resume handler correctly; the resulting mismatch can call `origin_postsuspend` twice and attempt to remove a list entry that was already removed. The issue was introduced in Linux kernel 3.19 and has a CVSS v3.1 score of 4.4, requiring local access and high privileges but posing a high availability impact. The vulnerability is fixed in stable kernel versions 4.19.311, 5.4.273, 5.10.214, 5.15.153, 6.1.83, 6.6.23, 6.7.11, 6.8.2, and later releases. Red Hat has issued corrected kernel packages for affected RHEL 8, RHEL 9, and RHEL 9.2 Extended Update Support deployments; RHEL 9 `kernel-rt` was still listed as affected, while RHEL 6 and 7 are outside supported remediation scope. Organizations should apply the applicable vendor kernel update and reboot affected hosts.
Aug 26, 2026