CVE-2026-64468

Status: UPDATED  |  Advisory ID: CVE-2026-64468

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

binder: fix UAF in binder_free_transaction()

In binder_free_transaction(), the t->to_proc is read under the t->lock.

However, once the t->lock is dropped, the to_proc can die in parallel.

This leads to a use-after-free error when we attempt to acquire its

inner lock right afterwards:

==================================================================

BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x1a0

Write of size 4 at addr ffff00001125da70 by task B/672

CPU: 20 UID: 0 PID: 672 Comm: B Not tainted 7.1.0-rc6-00284-g8e65320d91cd #4 PREEMPT

Hardware name: linux,dummy-virt (DT)

Call trace:

_raw_spin_lock+0xe4/0x1a0

binder_free_transaction+0x8c/0x320

binder_send_failed_reply+0x21c/0x2f8

binder_thread_release+0x488/0x7e0

binder_ioctl+0x12c0/0x29a0

[...]

Allocated by task 675:

__kmalloc_cache_noprof+0x174/0x444

binder_open+0x118/0xb70

do_dentry_open+0x374/0x1040

vfs_open+0x58/0x3bc

[...]

Freed by task 212:

__kasan_slab_free+0x58/0x80

kfree+0x1a0/0x4a4

binder_proc_dec_tmpref+0x32c/0x5e0

binder_deferred_func+0xc48/0x104c

process_one_work+0x53c/0xbc0

[...]

==================================================================

To prevent this, pin the target thread (t->to_thread) to guarantee the

target process remains alive. Undelivered transactions without a target

thread are already safe, as the target process can only be the current

context in those paths. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References