Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - 已解決 Linux 核心中的下列弱點：rust_binder: check ownership before using vma When installing missing pages (or zapping them), Rust Binder will look up the vma in the mm by address, and then call vm_insert_page (or zap_page_range_single). However, if the vma is closed and replaced with a different vma at the same address, this can lead to Rust Binder installing pages into the wrong vma. By installing the page into a writable vma, it becomes possible to write to your own binder pages, which are normally read-only. Although you're not supposed to be able to write to those pages, the intent behind the design of Rust Binder is that even if you get that ability, it should not lead to anything bad. Unfortunately, due to another bug, that is not the case. To fix this, store a pointer in vm_private_data and check that the vma returned by vma_lookup() has the right vm_ops and vm_private_data before trying to use the vma. This should ensure that Rust Binder will refuse to interact with any other VMA. The plan is to introduce more vma abstractions to avoid this unsafe access to vm_ops and vm_private_data, but for now let's start with the simplest possible fix. C Binder performs the same check in a slightly different way: it provides a vm_ops->close that sets a boolean to true, then checks that boolean after calling vma_lookup(), but this is more fragile than the solution in this patch. (We probably still want to do both, but the vm_ops->close callback will be added later as part of the follow-up vma API changes.) It's still possible to remap the vma so that pages appear in the right vma, but at the wrong offset, but this is a separate issue and will be fixed when Rust Binder gets a vm_ops->close callback.
    (CVE-2026-43434)

請注意，Nessus 依賴供應商報告的套件存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 已修复 Linux 内核中的下列漏洞：rust_binder: check ownership before using vma When installing missing pages (or zapping them), Rust Binder will look up the vma in the mm by address, and then call vm_insert_page (or zap_page_range_single). However, if the vma is closed and replaced with a different vma at the same address, this can lead to Rust Binder installing pages into the wrong vma. By installing the page into a writable vma, it becomes possible to write to your own binder pages, which are normally read-only. Although you're not supposed to be able to write to those pages, the intent behind the design of Rust Binder is that even if you get that ability, it should not lead to anything bad. Unfortunately, due to another bug, that is not the case. To fix this, store a pointer in vm_private_data and check that the vma returned by vma_lookup() has the right vm_ops and vm_private_data before trying to use the vma. This should ensure that Rust Binder will refuse to interact with any other VMA. The plan is to introduce more vma abstractions to avoid this unsafe access to vm_ops and vm_private_data, but for now let's start with the simplest possible fix. C Binder performs the same check in a slightly different way: it provides a vm_ops->close that sets a boolean to true, then checks that boolean after calling vma_lookup(), but this is more fragile than the solution in this patch. (We probably still want to do both, but the vm_ops->close callback will be added later as part of the follow-up vma API changes.) It's still possible to remap the vma so that pages appear in the right vma, but at the wrong offset, but this is a separate issue and will be fixed when Rust Binder gets a vm_ops->close callback.
    (CVE-2026-43434)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - rust_binder:vma を使用する前に所有権をチェックします 欠落しているページをインストールする(またはザッピングする)とき、Rust Binder はアドレスで mm の vma を検索してから、vm_insert_page (または zap_page_range_single) 呼び出します。
    ただし、vma が閉じられ、同じアドレスで別の vma に置き換えられると、Rust Binder が間違った vma にページをインストールする可能性があります。このページを書き込み可能な VMA にインストールすることで、通常は読み取り専用の独自のバインダーページに書き込むことができます。これらのページに書き込めるわけではありませんが、Rust Binder のデザインの背後にある意図は、たとえその能力を手に入れたとしても、それが悪いことにつながらないはずだということです。残念ながら、別のバグのために、そうではありません。これを修正するには、vm_private_data にポインターを保存し、vma の使用を試みる前に、vma_lookup() から返される vma が正しいvm_opsとvm_private_dataを持っていることを確認してください。これにより、Rust Binder が他の VMA との相互作用を拒否することが保証されます。計画では、vm_opsとvm_private_dataへのこの安全でないアクセスを回避するために、より多くのvma抽象化を導入する予定ですが、とりあえずは、可能な限り単純な修正から始めましょう。C Binder は、同じチェックを少し異なる方法で行います:ブール値を true に設定する vm_ops->close を提供し、vma_lookup() を呼び出した後にそのブール値をチェックしますが、これはこのパッチのソリューションよりも脆弱です。
    (おそらく両方を引き続き実行したいと思いますが、vm_ops->close コールバックは、フォローアップの vma API 変更の一部として後ほど追加される予定です。)ページが正しい vma で間違ったオフセットで表示されるように vma を再マッピングすることはまだ可能ですが、これは別の問題であり、Rust Binder が vm_ops->close コールバックを取得したときに修正されます。(CVE-2026-43434)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: rust_binder: check ownership before     using vma When installing missing pages (or zapping them), Rust Binder will look up the vma in the mm by     address, and then call vm_insert_page (or zap_page_range_single). However, if the vma is closed and     replaced with a different vma at the same address, this can lead to Rust Binder installing pages into the     wrong vma. By installing the page into a writable vma, it becomes possible to write to your own binder     pages, which are normally read-only. Although you're not supposed to be able to write to those pages, the     intent behind the design of Rust Binder is that even if you get that ability, it should not lead to     anything bad. Unfortunately, due to another bug, that is not the case. To fix this, store a pointer in     vm_private_data and check that the vma returned by vma_lookup() has the right vm_ops and vm_private_data     before trying to use the vma. This should ensure that Rust Binder will refuse to interact with any other     VMA. The plan is to introduce more vma abstractions to avoid this unsafe access to vm_ops and     vm_private_data, but for now let's start with the simplest possible fix. C Binder performs the same check     in a slightly different way: it provides a vm_ops->close that sets a boolean to true, then checks that     boolean after calling vma_lookup(), but this is more fragile than the solution in this patch. (We probably     still want to do both, but the vm_ops->close callback will be added later as part of the follow-up vma API     changes.) It's still possible to remap the vma so that pages appear in the right vma, but at the wrong     offset, but this is a separate issue and will be fixed when Rust Binder gets a vm_ops->close callback.
    (CVE-2026-43434)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名稱	產品	系列	已發布	已更新	嚴重性
315706	Linux Distros 未修補的弱點：CVE-2026-43434	Nessus	Misc.	2026/5/20	2026/10/20	high
315706	Linux Distros 未修补的漏洞：CVE-2026-43434	Nessus	Misc.	2026/5/20	2026/10/20	high
315706	Linux Distros のパッチ未適用の脆弱性: CVE-2026-43434	Nessus	Misc.	2026/5/20	2026/10/20	high
315706	Linux Distros Unpatched Vulnerability : CVE-2026-43434	Nessus	Misc.	2026/5/20	2026/10/20	high

偵測

搜尋 Plugin

high

high

high

high