Local privilege escalation via replaced Binder VMA

Race condition in Rust Binder in Linux Kernel 6.18 allows local users to gain kernel privileges through a replaced VMA. Rust Binder looks up a VMA by address after the original mapping can be closed and replaced, then vm_insert_page or zap_page_range_single acts on the replacement without verifying its vm_ops and vm_private_data ownership. A basic local user or Android app needs access to a Rust Binder device and must combine the writable Binder-page condition with the companion Binder flaw; the result is local privilege escalation with kernel-level impact.