i didn't expect to see this...

A CVE was discovered in Rust code within the Linux kernel's Android Binder driver, marking the first security vulnerability in kernel Rust code. The bug is a race condition in an unsafe block that handles doubly linked list operations for tracking node deaths. The vulnerability occurred because the code moved list items to a local stack copy and dropped the lock prematurely, allowing two threads to simultaneously access and modify the same list structure. This led to memory corruption and kernel crashes. The fix involved iterating over the list with proper locking instead of creating a local copy, demonstrating that even memory-safe languages require careful handling of concurrent operations in kernel code.