CVE-2025-38176

CVE-2025-38176 describes a use-after-free vulnerability in the Linux kernel's binderfs_evict_inode() function, affecting Linux kernel versions. This flaw, triggered by concurrent deletions from 'binder_devices', can lead to system instability or crashes. Rated with a CVSS score of 7.8 (High), the vulnerability has a local attack vector with low attack complexity, potentially allowing an authenticated local attacker to achieve high impact on confidentiality, integrity, and availability. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) or significant community discussion has been identified.