CVE-2026-43435

Description

In the Linux kernel, the following vulnerability has been resolved: rust_binder: fix oneway spam detection The spam detection logic in TreeRange was executed before the current request was inserted into the tree. So the new request was not being factored in the spam calculation. Fix this by moving the logic after the new range has been inserted. Also, the detection logic for ArrayRange was missing altogether which meant large spamming transactions could get away without being detected. Fix this by implementing an equivalent low_oneway_space() in ArrayRange. Note that I looked into centralizing this logic in RangeAllocator but iterating through 'state' and 'size' got a bit too complicated (for me) and I abandoned this effort.

Overview

State: PUBLISHED
Assigner (CNA): Linux
CVSS severity: high
CVSS score: 7.1 / 10
CVSS vector: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Effective score: 7.1 / 10 HIGH source: CNA overview
CWE(s): —
Reserved: 2026-05-01
Published: 2026-05-08 16:22 UTC
Last updated: 2026-05-12 00:24 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/43xxx/CVE-2026-43435.json
Linked Threat: CVE-2026-43435 — CVE-2026-43435

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-05-08 15:16:55 UTC
NVD last modified: 2026-05-12 14:10:27 UTC
EPSS score: 0.0002 (probability of exploitation in next 30 days)
EPSS percentile: 6.46% vs all CVEs — higher = more likely to be exploited, as of 2026-05-24

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-28741
Assigner: Linux
Published: May 8, 2026, 2:22:05 PM
Updated: May 11, 2026, 10:24:32 PM
EUVD base score: 0.0 / 10
EUVD-reported EPSS: 0.0100
Vendors: Linux
Products: Linux (patch: 6.18.19)

Linux (patch: 6.19.9)

Linux (patch: 7.0)

Linux (eafedbc7c050c44744fbdf80bdf3315e860b7513 <8d34c993a9a156e657e43cb95186980745cc3597)

Linux (6.18)

Linux (eafedbc7c050c44744fbdf80bdf3315e860b7513 <4fc87c240b8f30e22b7ebaae29d57105589e1c0b)

Linux (eafedbc7c050c44744fbdf80bdf3315e860b7513 <edf685946c4acbe57cb96f8d5f3c07e9a2e973c8)

Linux (patch: 0)

ENISA description: In the Linux kernel, the following vulnerability has been resolved: rust_binder: fix oneway spam detection The spam detection logic in TreeRange was executed before the current request was inserted into the tree. So the new request was not being factored in the spam calculation. Fix this by moving the logic after the new range has been inserted. Also, the detection logic for ArrayRange was missing altogether which meant large spamming transactions could get away without being detected. Fix this by implementing an equivalent low_oneway_space() in ArrayRange. Note that I looked into centralizing this logic in RangeAllocator but iterating through 'state' and 'size' got a bit too complicated (for me) and I abandoned this effort.

EUVD references (3)

Affected products (2)

Vendor	Product	Versions	Platforms
Linux	Linux	`eafedbc7c050c44744fbdf80bdf3315e860b7513` (affected), `eafedbc7c050c44744fbdf80bdf3315e860b7513` (affected), `eafedbc7c050c44744fbdf80bdf3315e860b7513` (affected)	—
Linux	Linux	`6.18` (affected), `0` (unaffected), `6.18.19` (unaffected), `6.19.9` (unaffected), `7.0` (unaffected)	—

Vendor references (3)

References embedded in the original CVE record by the assigning CNA.

MITRE references (3) cveawg.mitre.org

Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.

Web references (3)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

https://nvd.nist.gov/vuln/detail/CVE-2026-43435 tenable:nvd.nist.gov
https://www.cve.org/CVERecord?id=CVE-2026-43435 tenable:www.cve.org
https://www.first.org/epss/ tenable:www.first.org

NVD-tagged references (3)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://git.kernel.org/stable/c/4fc87c240b8f30e22b7ebaae29d57105589e1c0b 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/8d34c993a9a156e657e43cb95186980745cc3597 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/edf685946c4acbe57cb96f8d5f3c07e9a2e973c8 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Remediations (16)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

Patch Tuesday, April 2026 Edition - Krebs on Security

web:krebsonsecurity.com

For a clickable, per- patch breakdown, check out the SANS Internet Storm Center Patch Tuesday roundup. Running into problems applying any of these updates?

2026-05-23 21:04 UTC
Nvd - Cve-2026-43534

web:nvd.nist.gov

An official website of the United States government Here's how you know

2026-05-23 21:04 UTC
Security Update Guide - Microsoft

web:portal.msrc.microsoft.com

The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

2026-05-23 21:04 UTC
One Researcher, Three Defender Zero-Days, 13 Days

web:stateofsurveillance.org

A frustrated security researcher dumped three Windows Defender zero-days after Microsoft dismissed the reports. All three are actively exploited. Two remain unpatched. Here is what happened and what you should do.

2026-05-23 21:04 UTC
Three Microsoft Defender Zero-Days Actively Exploited; Two Still Unpatched

web:thehackernews.com

Three Defender zero-days exploited since April 10, 2026 , enabling privilege escalation and DoS, forcing isolation of affected systems.

2026-05-23 21:04 UTC
CVE-2026-34354: Guardicore Local Privilege Escalation Vulnerability

web:www.akamai.com

Read the technical details of a security vulnerability ( CVE - 2026 -34354) in Akamai Guardicore Platform Agent for Windows — and get clear guidance on mitigation .

2026-05-23 21:04 UTC
CISA orders feds to patch BlueHammer flaw exploited as zero-day

web:www.bleepingcomputer.com

CISA has ordered U.S. federal agencies to patch a Microsoft Defender privilege escalation flaw (dubbed BlueHammer) that has been exploited in zero-day attacks.

2026-05-23 21:04 UTC
Critical Patches Issued for Microsoft Products, April 14, 2026

web:www.cisecurity.org

<p>Multiple vulnerabilities have been discovered in Microsoft products, the most severe of which could allow for remote code execution. Successful exploitation of the most severe of these vulnerabilities could result in an attacker gaining the same privileges as the logged-on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or ...

2026-05-23 21:04 UTC
Windows 11 April 2026 Update tested: What's new, improved and fixed

web:www.windowslatest.com

Windows 11 April 2026 update adds Narrator Copilot support, faster Settings, File Explorer fixes, and key security improvements.

2026-05-23 21:04 UTC
Patch Tuesday May 2026: Security Updates & CVE Analysis

web:zecurit.com

Get the complete breakdown of Microsoft's May 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .

2026-05-23 21:04 UTC
Security Advisory Bulletin 064 | Ubiquiti Community

web:community.ui.com

Published: May 21, 2026 Updated: May 22, 2026 Version: 1.1 Revision: 1.1 Summary 1 of 5 A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection. Affected Products: UniFi OS Server (Version 5.0.6 and earlier) Mitigation : Update your UniFi OS Server to Version 5.0.8 or later ...

2026-05-26 02:48 UTC
CISA Warns of Exploited Microsoft Defender 0-Day Flaws

web:cyberpress.org

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two actively exploited Microsoft Defender vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, issuing an urgent remediation directive for federal agencies with a due date of June 3, 2026 .

2026-05-26 02:48 UTC
Security Update Guide - Microsoft

web:msrc.microsoft.com

The Microsoft Security Response Center (MSRC) investigates all reports of security vulnerabilities affecting Microsoft products and services, and provides the information here as part of the ongoing effort to help you manage security risks and help keep your systems protected.

2026-05-26 02:48 UTC
April 2026 Patch Tuesday: Updates and Analysis | CrowdStrike

web:www.crowdstrike.com

Microsoft's April 2026 Patch Tuesday addresses 164 CVEs , featuring 8 Critical vulnerabilities, one exploited zero-day, and one disclosed zero-day.

2026-05-26 02:48 UTC
Microsoft Copilot Agent Vulnerability (CVE-2026-35435): The 3-Step ...

web:www.myabt.com

Microsoft disclosed CVE - 2026 -35435 in Azure AI Foundry and M365 Published Agents May 8, 2026 . The 3-step inventory, audit, and patch check for FIs.

2026-05-26 02:48 UTC
Oracle Critical Patch Update Advisory - April 2026

web:www.oracle.com

This Critical Patch Update contains 481 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at April 2026 Critical Patch Update: Executive Summary and Analysis.

2026-05-26 02:48 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-43435.json.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/android/binder/range_alloc/array.rs",
            "drivers/android/binder/range_alloc/mod.rs",
            "drivers/android/binder/range_alloc/tree.rs"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "edf685946c4acbe57cb96f8d5f3c07e9a2e973c8",
              "status": "affected",
              "version": "eafedbc7c050c44744fbdf80bdf3315e860b7513",
              "versionType": "git"
            },
            {
              "lessThan": "8d34c993a9a156e657e43cb95186980745cc3597",
              "status": "affected",
              "version": "eafedbc7c050c44744fbdf80bdf3315e860b7513",
              "versionType": "git"
            },
            {
              "lessThan": "4fc87c240b8f30e22b7ebaae29d57105589e1c0b",
              "status": "affected",
              "version": "eafedbc7c050c44744fbdf80bdf3315e860b7513",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/android/binder/range_alloc/array.rs",
            "drivers/android/binder/range_alloc/mod.rs",
            "drivers/android/binder/range_alloc/tree.rs"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "lessThan": "6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.19",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.9",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrust_binder: fix oneway spam detection\n\nThe spam detection logic in TreeRange was executed before the current\nrequest was inserted into the tree. So the new request was not being\nfactored in the spam calculation. Fix this by moving the logic after\nthe new range has been inserted.\n\nAlso, the detection logic for ArrayRange was missing altogether which\nmeant large spamming transactions could get away without being detected.\nFix this by implementing an equivalent low_oneway_space() in ArrayRange.\n\nNote that I looked into centralizing this logic in RangeAllocator but\niterating through 'state' and 'size' got a bit too complicated (for me)\nand I abandoned this effort."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:24:32.185Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/edf685946c4acbe57cb96f8d5f3c07e9a2e973c8"
        },
        {
          "url": "https://git.kernel.org/stable/c/8d34c993a9a156e657e43cb95186980745cc3597"
        },
        {
          "url": "https://git.kernel.org/stable/c/4fc87c240b8f30e22b7ebaae29d57105589e1c0b"
        }
      ],
      "title": "rust_binder: fix oneway spam detection",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43435",
    "datePublished": "2026-05-08T14:22:05.921Z",
    "dateReserved": "2026-05-01T14:12:56.009Z",
    "dateUpdated": "2026-05-11T22:24:32.185Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}