CVE-2026-64469

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

binder: fix UAF in binder_thread_release()

When a thread exits, binder_thread_release() walks its transaction stack

to clear the t->from and t->to_proc that correspond with the exiting

thread. However, a process dying in parallel might attempt to kfree some

of these transactions. And if one of them has no associated t->to_proc,

the t->to_proc->inner_lock will not be acquired.

This means that transaction accesses in binder_thread_release() after

t->to_proc has been cleared might race with binder_free_transaction()

and cause a use-after-free error as reported by KASAN:

==================================================================

BUG: KASAN: slab-use-after-free in binder_thread_release+0x5d0/0x798

Write of size 8 at addr ffff000016627500 by task X/715

CPU: 17 UID: 0 PID: 715 Comm: X Not tainted 7.1.0-rc5-00149-g8fde5d1d47f6 #30 PREEMPT

Hardware name: linux,dummy-virt (DT)

Call trace:

binder_threa

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References