CVE-2026-98778

Received Received - Intake

Binder Use-After-Free in Linux Kernel

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: binder: fix is_failure flag for superseded transaction cleanup When a TF_UPDATE_TXN transaction supersedes a pending async transaction, binder_release_entire_buffer() is called with is_failure=false. Since the superseded transaction was never delivered, binder_apply_fd_fixups() was never called and no fds were installed in the target process. With is_failure=false, the BINDER_TYPE_FDA cleanup handler interprets stale buffer contents as installed fd numbers and passes them to binder_deferred_fd_close(), closing unrelated file descriptors. Pass is_failure=true since the transaction was never delivered to the target, matching the semantics of all other undelivered-transaction cleanup paths.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98778

EUVD

EUVD-2026-103863

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	9864bb4801331daa48514face9d0f4861e4d485b
Linux	Linux	9864bb4801331daa48514face9d0f4861e4d485b
Linux	Linux	9864bb4801331daa48514face9d0f4861e4d485b
Linux	Linux	9864bb4801331daa48514face9d0f4861e4d485b
Linux	Linux	6.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the binder driver where a superseded transaction cleanup incorrectly sets the is_failure flag to false. This causes the cleanup handler to misinterpret stale buffer contents as file descriptors and close unrelated file descriptors in the target process.

Detection Guidance

This vulnerability is specific to the Linux kernel's binder driver and requires kernel-level inspection. Detection involves checking kernel logs for binder-related errors or examining the kernel version for unpatched code. Commands like dmesg | grep binder or checking kernel version with uname -a may help identify affected systems.

Impact Analysis

This vulnerability could lead to unintended file descriptor closures in processes, potentially causing crashes, data corruption, or privilege escalation if critical file descriptors are closed unexpectedly.

Compliance Impact

This vulnerability in the Linux kernel could potentially lead to unauthorized file descriptor closures in a target process due to improper cleanup of superseded transactions. This may result in resource leaks or unintended process behavior, which could impact compliance with data protection standards like GDPR or HIPAA if it affects systems handling sensitive data.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the binder transaction cleanup issue described in CVE-2026-98778.

Hi! I’m here to help you understand CVE-2026-98778. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70