CVE-2026-23184
Use-After-Free Vulnerability in Linux Binder Netlink Report Function
Publication date: 2026-02-14
Last updated on: 2026-04-03
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | From 6.18 (inc) to 6.18.10 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-416 | The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a use-after-free (UAF) issue in the Linux kernel's binder subsystem, specifically in the binder_netlink_report() function.
When oneway transactions are sent to frozen targets via binder_proc_transaction(), they return a BR_TRANSACTION_PENDING_FROZEN error but are still treated as successful because the target is expected to thaw later. However, accessing the transaction object 't' after this error is unsafe because the transaction might have been consumed by the thawed target.
In this case, binder_netlink_report() dereferences 't' after a pending frozen error, leading to a use-after-free condition as confirmed by a Kernel Address Sanitizer (KASAN) report.
The fix involves making a copy of the transaction so that binder_netlink_report() can safely access the data even after a pending frozen error, avoiding the unsafe use of the original transaction buffer.
How can this vulnerability impact me? :
A use-after-free vulnerability like this can lead to undefined behavior in the kernel, including potential crashes, data corruption, or security breaches.
Since the binder subsystem is involved in inter-process communication in the Linux kernel, exploitation of this vulnerability could allow an attacker to execute arbitrary code or cause denial of service by triggering kernel memory corruption.
This could impact system stability and security, especially on systems relying on the Linux kernel for critical operations.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves a use-after-free (UAF) error in the Linux kernel's binder_netlink_report() function, which can be detected by monitoring kernel logs for KASAN (Kernel Address Sanitizer) reports indicating slab-use-after-free errors related to binder_netlink_report.
To detect this on your system, you can check the kernel logs for relevant error messages. For example, use the following command to search for binder_netlink_report related KASAN errors:
- dmesg | grep binder_netlink_report
Additionally, monitoring for binder-related errors or unusual binder transactions in the kernel logs may help identify attempts to exploit this vulnerability.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability has been resolved by modifying the binder_netlink_report() function to make a transaction copy so that data can be safely accessed after a pending frozen error, preventing use-after-free conditions.
Immediate mitigation steps include:
- Update your Linux kernel to a version that includes the fix for this vulnerability (post 6.19.0-rc6-00015-gc03e9c42ae8f or later).
- If updating is not immediately possible, consider restricting access to binder interfaces or limiting untrusted processes from sending oneway transactions to frozen targets.
- Monitor kernel logs for signs of exploitation attempts and apply security best practices to minimize exposure.