CVE-2026-99075 in Linux
Summary
by MITRE • 10/23/2026
In the Linux kernel, the following vulnerability has been resolved:
rust_binder: reschedule node refcount update on thread exit
When a thread exits via BINDER_THREAD_EXIT, its pending work items are cancelled. If a thread exits while holding a pending node refcount increment (e.g. pushed as deferred work to that thread), the refcount increment was previously dropped because Node::cancel() and NodeWrapper::cancel() were no-ops.
Dropping the refcount update leaves the node's delivery state and count state desynchronized, and userspace will not receive the notification, which can cause the node to never be freed from the process's nodes tree when all external references are dropped.
Fix this by implementing DeliverToRead::cancel() for Node and NodeWrapper to move the pending refcount update to the process's work queue on thread exit so another thread can deliver it to userspace.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The Linux kernel’s binder driver, which facilitates inter-process communication in Android-based systems, contained a critical synchronization flaw related to reference counting during thread termination. The vulnerability arises from the handling of deferred work items when a thread exits via the BINDER_THREAD_EXIT ioctl command. Specifically, if a thread is holding or has queued a pending node reference count increment as deferred work at the moment it terminates, that incremental update was previously discarded because the cancellation logic for Node and NodeWrapper objects were implemented as no-operations. This design oversight meant that any refcount updates scheduled to be delivered by the exiting thread were effectively lost rather than being preserved or reassigned.
This loss of reference count data leads directly to a state desynchronization between the kernel’s internal node delivery mechanisms and the actual reference counts maintained for binder nodes. In normal operation, when a binder node is no longer referenced by any process, it must be freed from the process's nodes tree to prevent resource leaks. However, because the refcount increment was dropped during thread exit, the system fails to account for that specific reference. Consequently, even after all external references are ostensibly removed, the internal bookkeeping retains a stale or incorrect count, preventing the kernel from recognizing that the node is truly unreferenced and eligible for cleanup.
The operational impact of this vulnerability includes memory leaks within the binder driver subsystem. Over time, as threads exit with pending refcount updates, these orphaned nodes accumulate in the process's nodes tree without being freed. This gradual accumulation consumes kernel memory unnecessarily and can eventually lead to resource exhaustion or degraded system performance if left unmitigated. Furthermore, userspace applications relying on accurate notification of node state changes may fail to receive expected events, potentially causing application-level logic errors or hangs where processes wait indefinitely for resources that are technically still held by the defunct thread’s context.
To resolve this issue, the fix implements a proper cancellation mechanism in DeliverToRead::cancel() for both Node and NodeWrapper structures. Instead of discarding pending work items upon thread exit, the updated code moves these pending refcount updates to the process's global work queue. This ensures that another active thread within the same process can pick up the deferred task and correctly deliver it to userspace or update internal state accordingly. By preserving the integrity of reference counting operations during thread lifecycle transitions, this patch restores synchronization between delivery states and count states, ensuring nodes are properly freed when appropriate.
From a security taxonomy perspective, this vulnerability aligns with CWE-401, which describes missing release of memory after effective lifetime, specifically manifesting as a resource leak due to improper cleanup procedures. The failure to correctly handle deferred work during thread termination represents an error in state management that leads to persistent allocation without corresponding deallocation logic. In terms of the MITRE ATT&CK framework, while this is primarily a stability and reliability issue rather than a direct exploitation vector for privilege escalation, it relates to techniques involving resource exhaustion or denial of service through inefficient resource management if exploited at scale by malicious actors creating numerous threads with pending binder operations.
Mitigation strategies involve applying the kernel patch that corrects the DeliverToRead::cancel() implementation. System administrators and developers should ensure their Linux kernels are updated to versions containing this fix, particularly in environments running Android or other systems heavily reliant on the binder IPC mechanism. Regular auditing of memory usage patterns within the binder subsystem can help detect early signs of such leaks before they impact system stability. Additionally, rigorous testing of thread exit scenarios involving deferred work items is recommended during kernel development cycles to prevent similar synchronization flaws from being introduced in future updates.