CVE-2026-98777

Received Received - Intake

Memory Leak in Linux Kernel Binder Driver

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: binder: fix leaked fd fixups on TF_UPDATE_TXN supersede When a TF_UPDATE_TXN transaction supersedes a pending async transaction in a frozen process, the outdated transaction is freed with kfree() directly. This skips binder_free_txn_fixups(), leaking all binder_txn_fd_fixup entries and their fget()'d struct file references. The leaked file refcounts never reach zero, so the struct file objects are permanently pinned in memory. They survive process exit and accumulate across invocations until file-max exhaustion. Every other transaction cleanup path (binder_free_transaction(), binder_transaction() error paths, binder_release_work()) correctly calls binder_free_txn_fixups(). Add the missing call before kfree() in the t_outdated cleanup block.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98777

EUVD

EUVD-2026-103862

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	9864bb4801331daa48514face9d0f4861e4d485b
Linux	Linux	9864bb4801331daa48514face9d0f4861e4d485b
Linux	Linux	9864bb4801331daa48514face9d0f4861e4d485b
Linux	Linux	9864bb4801331daa48514face9d0f4861e4d485b
Linux	Linux	6.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where a transaction cleanup path fails to call binder_free_txn_fixups(), causing file descriptor references to leak. These leaked references accumulate over time, pinning struct file objects in memory until system limits are exhausted.

Detection Guidance

This vulnerability is specific to the Linux kernel's binder driver and requires kernel-level inspection. Detection involves checking for leaked file descriptors and memory accumulation. Monitor system logs for binder-related errors or memory pressure. Use commands like 'dmesg | grep binder' or 'cat /proc/slabinfo | grep binder' to check for unusual binder activity. Track file descriptor usage with 'lsof' or 'ls /proc/*/fd' to identify processes with excessive open files.

Impact Analysis

The vulnerability can lead to file descriptor exhaustion, causing system-wide resource depletion. This may result in processes failing to open files, memory leaks, and potential system instability or crashes due to resource unavailability.

Compliance Impact

This vulnerability causes file descriptors to leak and remain pinned in memory indefinitely, which could lead to resource exhaustion and potential denial of service. It does not directly affect data confidentiality or integrity but may impact system availability and stability, potentially violating compliance requirements for service reliability and resource management in standards like GDPR or HIPAA.

Mitigation Strategies

Apply the latest Linux kernel patches to resolve the binder driver issue. Reboot the system to clear any leaked file references. Monitor memory usage and file descriptor counts post-reboot. If immediate patching is not possible, consider isolating affected systems or disabling binder-related services temporarily.

Hi! I’m here to help you understand CVE-2026-98777. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70