Privilege escalation via mutable Binder offsets

A TOCTOU race in Rust Binder in Linux Kernel allows local users to escalate privileges through a crafted transaction payload. Transaction handling copies offsets into the target process's read-only VMA and then rereads them, allowing a writable target to change an offset before interpretation. Exploitation requires another Binder flaw that makes the target VMA writable and a specifically shaped sender payload; the receiver then gains the sender's privileges.