In the Linux kernel, the following vulnerability has been resolved: binder: fix leaked fd fixups on TF_UPDATE_TXN supersede When a TF_UPDATE_TXN… (CVE-2026-98777)

The Linux kernel binder driver had a flaw where, during a TF_UPDATE_TXN transaction superseding a pending async transaction in a frozen process, the outdated transaction was freed directly with kfree() without calling binder_free_txn_fixups(). This omission caused binder_txn_fd_fixup entries and their associated struct file references to leak, as their reference counts never reached zero. Consequently, these struct file objects remained pinned in memory even after process exit, accumulating over time until the system's file descriptor limit (file-max) was exhausted. Other transaction cleanup paths correctly invoked binder_free_txn_fixups(), but this specific path did not. The fix involved adding the missing call to binder_free_txn_fixups() before freeing the outdated transaction.

The vulnerability causes a resource leak of file descriptor fixups and their associated file references, which remain pinned in memory indefinitely. Over time, this can lead to exhaustion of the system's file descriptor limit (file-max), potentially impacting system stability and availability by preventing new file descriptors from being allocated.

A fix for this vulnerability has been implemented in the Linux kernel by adding the missing call to binder_free_txn_fixups() before freeing outdated transactions in the TF_UPDATE_TXN supersede path. Users should apply the official kernel updates that include this fix. Since no patch links or vendor advisories are provided here, check the Linux kernel official repositories or vendor advisories for the specific patched versions and apply updates accordingly.