CVE-2026-23184

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

binder: fix UAF in binder_netlink_report()

Oneway transactions sent to frozen targets via binder_proc_transaction()

return a BR_TRANSACTION_PENDING_FROZEN error but they are still treated

as successful since the target is expected to thaw at some point. It is

then not safe to access 't' after BR_TRANSACTION_PENDING_FROZEN errors

as the transaction could have been consumed by the now thawed target.

This is the case for binder_netlink_report() which derreferences 't'

after a pending frozen error, as pointed out by the following KASAN

report:

==================================================================

BUG: KASAN: slab-use-after-free in binder_netlink_report.isra.0+0x694/0x6c8

Read of size 8 at addr ffff00000f98ba38 by task binder-util/522

CPU: 4 UID: 0 PID: 522 Comm: binder-util Not tainted 6.19.0-rc6-00015-gc03e9c42ae8f #1 PREEMPT

Hardware name: linux,dummy-virt (DT)

Call trace:

binder_netlink_

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References