Executive brief
A vulnerability was identified in the Linux kernel's Android Binder component, which handles communication between different processes. A flaw in how the system manages memory during transaction cleanup could allow a local attacker to cause a system crash or potentially execute unauthorized code. This issue primarily affects Android-based systems and other Linux distributions using the Binder driver.
Technical details
A use-after-free (UAF) vulnerability exists in the binder_free_transaction() function within drivers/android/binder.c. The root cause is a race condition where t->to_proc is accessed after the t->lock is released, allowing the target process to be freed in parallel before its inner lock is acquired. An attacker can exploit this by triggering a transaction failure and simultaneously terminating the target process, leading to a slab-use-after-free during spinlock acquisition. The fix involves pinning the target thread (t->to_thread) to ensure the associated process remains valid during the cleanup routine.
Affected products
- Linux Linux Kernel versions before 5602a43f251c3d75312df91a422675fc00ca3dce, 0be901ab1dcc4af59b88f2e324493bb283850167, 48aeda9f8039e4a6971d1804578efde7f2c01eda, 45df558c543bb5543bacc8065fd7c567740781e5
Timeline
- 2026-06-19: other: Vulnerability fixed in source code
- 2026-07-25: disclosed: CVE published
References
- https://git.kernel.org/stable/c/0be901ab1dcc4af59b88f2e324493bb283850167
- https://git.kernel.org/stable/c/0f15f0f6ca5df566275ce517f257af2559528b41
- https://git.kernel.org/stable/c/328ccf32acb87e8bbb1fe2b065068c574e4db2bf
- https://git.kernel.org/stable/c/45df558c543bb5543bacc8065fd7c567740781e5
- https://git.kernel.org/stable/c/48aeda9f8039e4a6971d1804578efde7f2c01eda
- https://git.kernel.org/stable/c/5602a43f251c3d75312df91a422675fc00ca3dce
- https://git.kernel.org/stable/c/d45ef513eed1abebfec90c3cfb6ae50c2a4182db