CVE-2026-64468

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

binder: fix UAF in binder_free_transaction()

In binder_free_transaction(), the t->to_proc is read under the t->lock.

However, once the t->lock is dropped, the to_proc can die in parallel.

This leads to a use-after-free error when we attempt to acquire its

inner lock right afterwards:

==================================================================

BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x1a0

Write of size 4 at addr ffff00001125da70 by task B/672

CPU: 20 UID: 0 PID: 672 Comm: B Not tainted 7.1.0-rc6-00284-g8e65320d91cd #4 PREEMPT

Hardware name: linux,dummy-virt (DT)

Call trace:

_raw_spin_lock+0xe4/0x1a0

binder_free_transaction+0x8c/0x320

binder_send_failed_reply+0x21c/0x2f8

binder_thread_release+0x488/0x7e0

binder_ioctl+0x12c0/0x29a0

[...]

Allocated by task 675:

__kmalloc_cache_noprof+0x174/0x444

binder_open+0x118/0xb70

do_dentry_open+0x374/0x1040

vfs_ope

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References