CVE-2026-64468 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
binder: fix UAF in binder_free_transaction()
In binder_free_transaction(), the t->to_proc is read under the t->lock. However, once the t->lock is dropped, the to_proc can die in parallel. This leads to a use-after-free error when we attempt to acquire its inner lock right afterwards:
================================================================== BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x1a0 Write of size 4 at addr ffff00001125da70 by task B/672
CPU: 20 UID: 0 PID: 672 Comm: B Not tainted 7.1.0-rc6-00284-g8e65320d91cd #4 PREEMPT Hardware name: linux,dummy-virt (DT) Call trace: _raw_spin_lock+0xe4/0x1a0 binder_free_transaction+0x8c/0x320 binder_send_failed_reply+0x21c/0x2f8 binder_thread_release+0x488/0x7e0 binder_ioctl+0x12c0/0x29a0 [...]
Allocated by task 675: __kmalloc_cache_noprof+0x174/0x444 binder_open+0x118/0xb70 do_dentry_open+0x374/0x1040 vfs_open+0x58/0x3bc [...]
Freed by task 212: __kasan_slab_free+0x58/0x80 kfree+0x1a0/0x4a4 binder_proc_dec_tmpref+0x32c/0x5e0 binder_deferred_func+0xc48/0x104c process_one_work+0x53c/0xbc0 [...]
==================================================================
To prevent this, pin the target thread (t->to_thread) to guarantee the target process remains alive. Undelivered transactions without a target thread are already safe, as the target process can only be the current context in those paths.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/25/2026
The vulnerability described represents a use-after-free condition in the Linux kernel's binder driver, specifically within the binder_free_transaction() function. This flaw occurs due to improper synchronization mechanisms that fail to maintain reference integrity during critical sections of code execution. The issue manifests when a transaction object is being freed while another thread may simultaneously terminate the target process, creating a window where memory access occurs after deallocation.
The technical root cause lies in how the binder subsystem manages concurrent access to transaction objects and their associated process references. In binder_free_transaction(), the code reads t->to_proc under the protection of t->lock but subsequently releases this lock before performing operations on the target process. During this unlocked period, another execution path may invoke binder_proc_dec_tmpref() which ultimately calls kfree() on the target process structure, leading to immediate memory corruption upon subsequent access attempts.
This vulnerability directly maps to CWE-416, representing a use-after-free condition in kernel space memory management. The security implications extend beyond simple memory corruption as this represents a potential privilege escalation vector that could be exploited by malicious processes to gain elevated system privileges. The attack surface is particularly concerning given binder's role in Android's inter-process communication framework where it serves as the primary mechanism for system services and applications to communicate with each other.
The operational impact of this vulnerability affects all systems running Linux kernels with binder support, particularly those implementing Android-based systems or using binder as a core IPC mechanism. The condition can lead to kernel crashes, system instability, and potentially allow attackers to execute arbitrary code in kernel space with full system privileges. The timing window for exploitation is relatively narrow but sufficient for successful attack execution under certain load conditions.
The mitigation strategy proposed addresses the fundamental synchronization issue by pinning the target thread reference through t->to_thread to ensure the target process remains accessible throughout the transaction cleanup process. This approach follows established kernel security patterns where reference counting and explicit locking mechanisms prevent premature deallocation of critical resources. The solution leverages existing kernel infrastructure to maintain object lifetime guarantees while preserving functional correctness.
This vulnerability analysis aligns with ATT&CK framework techniques related to privilege escalation and kernel exploitation, specifically targeting T1068 (Local Privilege Escalation) and T1543 (Create or Modify System Process). The fix demonstrates proper kernel security engineering practices by implementing defensive programming measures that prevent race conditions through explicit reference management rather than relying on implicit synchronization. The approach ensures that transaction cleanup operations maintain consistent state throughout their execution lifecycle, preventing both the immediate use-after-free condition and potential secondary exploitation vectors that could arise from memory corruption.