{
  "cveId": "CVE-2026-23194",
  "url": "https://patchblox.com/security/cve/CVE-2026-23194",
  "summary": "CVE-2026-23194 is fixed in linux on 1 platform by DEBIAN-CVE-2026-23194 (version 6.18.10-1), released February 14, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  rust_binder: correctly handle FDA objects of len...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  rust_binder: correctly handle FDA objects of length zero  Fix a bug where an empty FDA (fd array) object with 0 fds would cause an out-of-bounds error. The previous implementation used \u0060skip == 0\u0060 to mean \u0022this is a pointer fixup\u0022, but 0 is also the correct skip length for an empty FDA. If the FDA is at the end of the buffer, then this results in an attempt to write 8-bytes out of bounds. This is caught and results in an EINVAL error being returned to userspace.  The pattern of using \u0060skip == 0\u0060 as a special value originates from the C-implementation of Binder. As part of fixing this bug, this pattern is replaced with a Rust enum.  I considered the alternate option of not pushing a fixup when the length is zero, but I think it\u0027s cleaner to just get rid of the zero-is-special stuff.  The root cause of this bug was diagnosed by Gemini CLI on first try. I used the following prompt:  \u003E There appears to be a bug in @drivers/android/binder/thread.rs where \u003E the Fixups oob bug is triggered with 316 304 316 324. This implies \u003E that we somehow ended up with a fixup where buffer A has a pointer to \u003E buffer B, but the pointer is located at an index in buffer A that is \u003E out of bounds. Please investigate the code to find the bug. You may \u003E compare with @drivers/android/binder.c that implements this correctly.",
  "published": "2026-02-14T17:15:57Z",
  "severity": "high",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00131,
  "epssPercentile": 0.02748,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.18.10-1",
      "fix": "DEBIAN-CVE-2026-23194",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-23194",
      "released": "2026-02-14T17:15:57Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}