{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.18.8-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  rust_binder: remove spin_lock() in rust_shrink_free_page()  When forward-porting Rust Binder to 6.18, I neglected to take commit fb56fdf8b9a2 (\"mm/list_lru: split the lock to per-cgroup scope\") into account, and apparently I did not end up running the shrinker callback when I sanity tested the driver before submission. This leads to crashes like the following:  \t============================================ \tWARNING: possible recursive locking detected \t6.18.0-mainline-maybe-dirty #1 Tainted: G          IO \t-------------------------------------------- \tkswapd0/68 is trying to acquire lock: \tffff956000fa18b0 (\u0026l-\u003elock){+.+.}-{2:2}, at: lock_list_lru_of_memcg+0x128/0x230  \tbut task is already holding lock: \tffff956000fa18b0 (\u0026l-\u003elock){+.+.}-{2:2}, at: rust_helper_spin_lock+0xd/0x20  \tother info that might help us debug this: \t Possible unsafe locking scenario:  \t       CPU0 \t       ---- \t  lock(\u0026l-\u003elock); \t  lock(\u0026l-\u003elock);  \t *** DEADLOCK ***  \t May be due to missing lock nesting notation  \t3 locks held by kswapd0/68: \t #0: ffffffff90d2e260 (fs_reclaim){+.+.}-{0:0}, at: kswapd+0x597/0x1160 \t #1: ffff956000fa18b0 (\u0026l-\u003elock){+.+.}-{2:2}, at: rust_helper_spin_lock+0xd/0x20 \t #2: ffffffff90cf3680 (rcu_read_lock){....}-{1:2}, at: lock_list_lru_of_memcg+0x2d/0x230  To fix this, remove the spin_lock() call from rust_shrink_free_page().",
  "id": "DEBIAN-CVE-2025-71181",
  "modified": "2026-09-01T19:48:39.084404414Z",
  "published": "2026-01-31T12:16:03.353Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2025-71181"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2025-71181"
  ]
}