CVE-2026-98778 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
binder: fix is_failure flag for superseded transaction cleanup
When a TF_UPDATE_TXN transaction supersedes a pending async transaction, binder_release_entire_buffer() is called with is_failure=false. Since the superseded transaction was never delivered, binder_apply_fd_fixups() was never called and no fds were installed in the target process.
With is_failure=false, the BINDER_TYPE_FDA cleanup handler interprets stale buffer contents as installed fd numbers and passes them to binder_deferred_fd_close(), closing unrelated file descriptors.
Pass is_failure=true since the transaction was never delivered to the target, matching the semantics of all other undelivered-transaction cleanup paths.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/18/2026
The Linux kernel's Binder IPC mechanism serves as a critical component for inter-process communication within Android and other embedded systems, facilitating efficient data transfer between processes through a shared memory model. A specific vulnerability was identified in the transaction handling logic where the is_failure flag was incorrectly set during the cleanup of superseded transactions. This issue arises specifically when a TF_UPDATE_TXN operation supersedes an existing pending asynchronous transaction. In this scenario, the kernel invokes binder_release_entire_buffer() with the is_failure parameter explicitly set to false, indicating that the transaction completed successfully or without error from the perspective of the buffer release logic. However, because the superseded transaction was never actually delivered to its target process, any associated file descriptor fixups were not applied via binder_apply_fd_fixups(). This creates a state inconsistency where the cleanup routine assumes normal completion semantics despite the transaction being aborted before delivery.
The core technical flaw lies in how the BINDER_TYPE_FDA cleanup handler interprets buffer contents when is_failure is false. Under normal successful delivery scenarios, file descriptors are installed into the target process's namespace, and their corresponding entries in the binder buffer reflect valid references. When is_failure is incorrectly set to false for an undelivered transaction, the cleanup logic mistakenly treats stale or uninitialized data within the buffer as if they were successfully installed file descriptor numbers. Consequently, these invalid values are passed directly to binder_deferred_fd_close(), which proceeds to close unrelated and potentially critical file descriptors in the target process. This misinterpretation of memory contents leads to unintended resource deallocation, effectively causing a denial of service for any application relying on those specific file handles or leading to undefined behavior as processes attempt to operate with closed resources they believe are still open.
The operational impact of this vulnerability is significant, particularly in multi-process environments where Binder transactions are frequent and complex. By closing unrelated file descriptors, the flaw can cause immediate crashes in affected applications, data corruption if files were being written to or read from, and broader system instability depending on which resources were inadvertently closed. Since file descriptor leaks or premature closures can cascade into larger security issues such as privilege escalation via race conditions or information disclosure through leaked handles, this bug represents a substantial risk to the integrity of the operating environment. The vulnerability is classified under CWE-787: Out-of-bounds Write in terms of logic flow leading to invalid resource management, and it aligns with ATT&CK technique T1053: Scheduled Task/Job if viewed through the lens of disrupting system availability or service continuity within a containerized or sandboxed environment.
To mitigate this vulnerability, kernel developers corrected the logic by ensuring that is_failure is passed as true when cleaning up superseded transactions that were never delivered to the target process. This adjustment aligns the cleanup behavior with the semantics used in all other undelivered-transaction paths, preventing the misinterpretation of buffer contents and stopping the erroneous closure of unrelated file descriptors. System administrators should ensure their Linux kernels are updated to versions containing this fix, particularly if running Android-based systems or custom embedded distributions that rely heavily on Binder IPC for inter-process communication. Regular patching cycles and monitoring for kernel updates remain essential practices to maintain system integrity against such low-level resource management flaws.