The Linux kernel binder driver had a vulnerability where the size of the security context (secctx) was zeroed before being used to calculate buffer boundaries in binder_transaction(). Specifically, the code subtracted the aligned LSM context size from the scatter-gather buffer end offset, but since the length field was cleared by a memset call before this subtraction, the subtraction was effectively zero. This caused the buffer boundary to be larger than intended, allowing copy operations to overflow into the memory area containing the security context. The fix involves caching the aligned size of the security context before it is cleared and using this cached value in calculations, preventing the overflow.

This vulnerability could allow a buffer overflow within the binder driver during transactions involving security context data. The overflow could lead to memory corruption by copying data beyond intended buffer boundaries into the area holding the security context. The exact impact depends on how this memory corruption is leveraged, but it could potentially affect kernel memory integrity or security context data. No known exploits in the wild have been reported.

A fix for this vulnerability has been implemented by caching the aligned security context size before it is cleared and using this cached value in buffer boundary calculations. Users should apply the official Linux kernel updates that include this fix. Since this is a kernel-level issue, updating to the patched kernel version is the recommended remediation. Patch status is not explicitly confirmed in the provided data; users should consult the official Linux kernel advisories or vendor patches for the exact fixed versions and apply updates accordingly.