CVE-2026-98778
Received
Received - Intake
Binder Use-After-Free in Linux Kernel
Vulnerability report for CVE-2026-98778, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-18
Last updated on: 2026-10-18
Assigner: kernel.org
Description
Description
In the Linux kernel, the following vulnerability has been resolved:
binder: fix is_failure flag for superseded transaction cleanup
When a TF_UPDATE_TXN transaction supersedes a pending async transaction,
binder_release_entire_buffer() is called with is_failure=false. Since the
superseded transaction was never delivered, binder_apply_fd_fixups() was
never called and no fds were installed in the target process.
With is_failure=false, the BINDER_TYPE_FDA cleanup handler interprets
stale buffer contents as installed fd numbers and passes them to
binder_deferred_fd_close(), closing unrelated file descriptors.
Pass is_failure=true since the transaction was never delivered to the
target, matching the semantics of all other undelivered-transaction
cleanup paths.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Linux | Linux | 9864bb4801331daa48514face9d0f4861e4d485b |
| Linux | Linux | 9864bb4801331daa48514face9d0f4861e4d485b |
| Linux | Linux | 9864bb4801331daa48514face9d0f4861e4d485b |
| Linux | Linux | 9864bb4801331daa48514face9d0f4861e4d485b |
| Linux | Linux | 6.0 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
