CVE-2026-64468
Received Received - Intake

Use-After-Free in Linux Kernel binder Driver

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF in binder_free_transaction() In binder_free_transaction(), the t->to_proc is read under the t->lock. However, once the t->lock is dropped, the to_proc can die in parallel. This leads to a use-after-free error when we attempt to acquire its inner lock right afterwards: ================================================================== BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x1a0 Write of size 4 at addr ffff00001125da70 by task B/672 CPU: 20 UID: 0 PID: 672 Comm: B Not tainted 7.1.0-rc6-00284-g8e65320d91cd #4 PREEMPT Hardware name: linux,dummy-virt (DT) Call trace: _raw_spin_lock+0xe4/0x1a0 binder_free_transaction+0x8c/0x320 binder_send_failed_reply+0x21c/0x2f8 binder_thread_release+0x488/0x7e0 binder_ioctl+0x12c0/0x29a0 [...] Allocated by task 675: __kmalloc_cache_noprof+0x174/0x444 binder_open+0x118/0xb70 do_dentry_open+0x374/0x1040 vfs_open+0x58/0x3bc [...] Freed by task 212: __kasan_slab_free+0x58/0x80 kfree+0x1a0/0x4a4 binder_proc_dec_tmpref+0x32c/0x5e0 binder_deferred_func+0xc48/0x104c process_one_work+0x53c/0xbc0 [...] ================================================================== To prevent this, pin the target thread (t->to_thread) to guarantee the target process remains alive. Undelivered transactions without a target thread are already safe, as the target process can only be the current context in those paths.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-64468
EUVD
EUVD-2026-48812

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel 7.1.0-rc6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free (UAF) vulnerability in the Linux kernel's binder driver. It occurs when binder_free_transaction() reads t->to_proc under a lock but the process dies after the lock is released. This leads to accessing freed memory when trying to lock the now-dead process's inner lock.

Detection Guidance

This vulnerability is specific to the Linux kernel's binder driver and may not have direct network detection methods. Monitor kernel logs for KASAN reports indicating slab-use-after-free errors in binder_free_transaction or related functions. Check for crashes or hangs in processes using binder IPC.

Impact Analysis

This vulnerability could cause system crashes, kernel panics, or privilege escalation if exploited. It may lead to denial-of-service conditions or allow attackers to execute arbitrary code in the kernel context.

Mitigation Strategies

Apply the kernel patch that fixes the UAF in binder_free_transaction. Update to a kernel version containing the fix. If immediate patching is not possible, restrict access to binder IPC or disable vulnerable binder features temporarily.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64468. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart