Answer in brief
CVE-2025-40028 records a Unknown severity vulnerability in binder: fix double-free in dbitmap. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=15d9da3f818cae676f822a04407d3c17b53357d2 <c301ec61ce6f16e21a36b99225ca8a20c1591e10 || >=15d9da3f818cae676f822a04407d3c17b53357d2 <0390633979969c54c0ce6a198d6f45cdbe2c84b1 || >=15d9da3f818cae676f822a04407d3c17b53357d2 <b781e5635a3398e2b64440371233c2c5102cd6cb || >=15d9da3f818cae676f822a04407d3c17b53357d2 <3ebcd3460cad351f198c39c6edb4af519a0ed934 | c301ec61ce6f16e21a36b99225ca8a20c1591e10, 0390633979969c54c0ce6a198d6f45cdbe2c84b1, b781e5635a3398e2b64440371233c2c5102cd6cb, 3ebcd3460cad351f198c39c6edb4af519a0ed934 |
| Linux/Linuxgeneric | 6.11 | Not reported |
Published upstream
Oct 28, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: binder: fix double-free in dbitmap A process might fail to allocate a new bitmap when trying to expand its proc->dmap. In that case, dbitmap_grow() fails and frees the old bitmap via dbitmap_free(). However, the driver calls dbitmap_free() again when the same process terminates, leading to a double-free error: ================================================================== BUG: KASAN: double-free in binder_proc_dec_tmpref+0x2e0/0x55c Free of addr ffff00000b7c1420 by task kworker/9:1/209 CPU: 9 UID: 0 PID: 209 Comm: kworker/9:1 Not tainted 6.17.0-rc6-dirty #5 PREEMPT Hardware name: linux,dummy-virt (DT) Workqueue: events binder_deferred_func Call trace: kfree+0x164/0x31c binder_proc_dec_tmpref+0x2e0/0x55c binder_deferred_func+0xc24/0x1120 process_one_work+0x520/0xba4 [...] Allocated by task 448: __kmalloc_noprof+0x178/0x3c0 bitmap_zalloc+0x24/0x30 binder_open+0x14c/0xc10 [...] Freed by task 449: kfree+0x184/0x31c binder_inc_ref_for_node+0xb44/0xe44 binder_transaction+0x29b4/0x7fbc binder_thread_write+0x1708/0x442c binder_ioctl+0x1b50/0x2900 [...] ================================================================== Fix this issue by marking proc->map NULL in dbitmap_free().
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2025-40028 records a Unknown severity vulnerability in binder: fix double-free in dbitmap. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=15d9da3f818cae676f822a04407d3c17b53357d2 <c301ec61ce6f16e21a36b99225ca8a20c1591e10 || >=15d9da3f818cae676f822a04407d3c17b53357d2 <0390633979969c54c0ce6a198d6f45cdbe2c84b1 || >=15d9da3f818cae676f822a04407d3c17b53357d2 <b781e5635a3398e2b64440371233c2c5102cd6cb || >=15d9da3f818cae676f822a04407d3c17b53357d2 <3ebcd3460cad351f198c39c6edb4af519a0ed934 | c301ec61ce6f16e21a36b99225ca8a20c1591e10, 0390633979969c54c0ce6a198d6f45cdbe2c84b1, b781e5635a3398e2b64440371233c2c5102cd6cb, 3ebcd3460cad351f198c39c6edb4af519a0ed934 |
| Linux/Linuxgeneric | 6.11 | Not reported |
Published upstream
Oct 28, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: binder: fix double-free in dbitmap A process might fail to allocate a new bitmap when trying to expand its proc->dmap. In that case, dbitmap_grow() fails and frees the old bitmap via dbitmap_free(). However, the driver calls dbitmap_free() again when the same process terminates, leading to a double-free error: ================================================================== BUG: KASAN: double-free in binder_proc_dec_tmpref+0x2e0/0x55c Free of addr ffff00000b7c1420 by task kworker/9:1/209 CPU: 9 UID: 0 PID: 209 Comm: kworker/9:1 Not tainted 6.17.0-rc6-dirty #5 PREEMPT Hardware name: linux,dummy-virt (DT) Workqueue: events binder_deferred_func Call trace: kfree+0x164/0x31c binder_proc_dec_tmpref+0x2e0/0x55c binder_deferred_func+0xc24/0x1120 process_one_work+0x520/0xba4 [...] Allocated by task 448: __kmalloc_noprof+0x178/0x3c0 bitmap_zalloc+0x24/0x30 binder_open+0x14c/0xc10 [...] Freed by task 449: kfree+0x184/0x31c binder_inc_ref_for_node+0xb44/0xe44 binder_transaction+0x29b4/0x7fbc binder_thread_write+0x1708/0x442c binder_ioctl+0x1b50/0x2900 [...] ================================================================== Fix this issue by marking proc->map NULL in dbitmap_free().
Quoted source text, attributed separately from HOL analysis.