In the Linux kernel, the following vulnerability has been resolved: binder: fix is_failure flag for superseded transaction cleanup When a… (CVE-2026-98778)

The Linux kernel binder driver had a flaw where, during the cleanup of a superseded asynchronous transaction (TF_UPDATE_TXN), the is_failure flag was incorrectly set to false. Because the superseded transaction was never delivered, no file descriptors were installed in the target process. However, with is_failure=false, the cleanup handler treated stale buffer contents as valid file descriptors and closed unrelated file descriptors. The fix changes the is_failure flag to true in this scenario, matching the semantics of other undelivered transaction cleanup paths and preventing unintended file descriptor closures.

This vulnerability could lead to unintended closure of unrelated file descriptors in processes using the binder driver. This may cause application errors or resource mismanagement but does not directly indicate privilege escalation or code execution. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to correctly set the is_failure flag during superseded transaction cleanup. Users should apply the official kernel updates containing this fix once available. No other mitigation steps are indicated.