CVE-2026-23400

In the Linux kernel, the following vulnerability has been resolved:

rustbinder: call setnotification_done() without proc lock

Consider the following sequence of events on a death listener: 1. The remote process dies and sends a BRDEADBINDER message. 2. The local process invokes the BCCLEARDEATHNOTIFICATION command. 3. The local process then invokes the BCDEADBINDERDONE. Then, the kernel will reply to the BCDEADBINDERDONE command with a BRCLEARDEATHNOTIFICATIONDONE reply using pushworkiflooper().

However, this can result in a deadlock if the current thread is not a looper. This is because deadbinderdone() still holds the proc lock during setnotificationdone(), which called pushworkiflooper(). Normally, pushworkiflooper() takes the thread lock, which is fine to take under the proc lock. But if the current thread is not a looper, then it falls back to delivering the reply to the process work queue, which involves taking the proc lock. Since the proc lock is already held, this is a deadlock.

Fix this by releasing the proc lock during setnotificationdone(). It was not intentional that it was held during that function to begin with.

I don't think this ever happens in Android because BCDEADBINDERDONE is only invoked in response to BRDEADBINDER messages, and the kernel always delivers BRDEADBINDER to a looper. So there's no scenario where Android userspace will call BCDEADBINDERDONE on a non-looper thread.