In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF in binder_free_transaction() In binder_free_transaction(), the… (CVE-2026-64468)
In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF in binder_free_transaction() In binder_free_transaction(), the t->to_proc is read under the t->lock. However, once the t->lock is dropped, the to_proc can die in parallel. This leads to a use-after-free error when we attempt to acquire its inner lock right afterwards: ================================================================== BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x1a0 Write of size 4 at addr ffff00001125da70 by task B/672 CPU: 20 UID: 0 PID: 672 Comm: B Not tainted 7.1.0-rc6-00284-g8e65320d91cd #4 PREEMPT Hardware name: linux,dummy-virt (DT) Call trace: _raw_spin_lock+0xe4/0x1a0 binder_free_transaction+0x8c/0x320 binder_send_failed_reply+0x21c/0x2f8 binder_thread_release+0x488/0x7e0 binder_ioctl+0x12c0/0x29a0 [...] Allocated by task 675: __kmalloc_cache_noprof+0x174/0x444 binder_open+0x118/0xb70 do_dentry_open+0x374/0x1040 vfs_open+0x58/0x3bc [...] Freed by task 212: __kasan_slab_free+0x58/0x80 kfree+0x1a0/0x4a4 binder_proc_dec_tmpref+0x32c/0x5e0 binder_deferred_func+0xc48/0x104c process_one_work+0x53c/0xbc0 [...] ================================================================== To prevent this, pin the target thread (t->to_thread) to guarantee the target process remains alive. Undelivered transactions without a target thread are already safe, as the target process can only be the current context in those paths.
AI Analysis
Technical Summary
The Linux kernel binder driver contained a use-after-free vulnerability in the binder_free_transaction() function. Specifically, the target process pointer (t->to_proc) is read while holding the transaction lock (t->lock), but after releasing this lock, the target process can be freed concurrently. Subsequent attempts to acquire the inner lock of the freed process lead to a use-after-free error, as detected by KASAN. The vulnerability was addressed by pinning the target thread (t->to_thread) to guarantee the target process remains alive during the transaction freeing, preventing the UAF condition.
Potential Impact
This vulnerability can lead to kernel memory corruption due to use-after-free, potentially causing system crashes or instability. No specific exploitation details or active exploits are reported. The impact is limited to kernel-level memory safety and stability issues.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to address this vulnerability by pinning the target thread to ensure the target process remains alive during transaction freeing. Users should apply the official Linux kernel updates that include this fix. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor or Linux kernel advisories for the current remediation guidance.
In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF in binder_free_transaction() In binder_free_transaction(), the… (CVE-2026-64468)
Description
In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF in binder_free_transaction() In binder_free_transaction(), the t->to_proc is read under the t->lock. However, once the t->lock is dropped, the to_proc can die in parallel. This leads to a use-after-free error when we attempt to acquire its inner lock right afterwards: ================================================================== BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x1a0 Write of size 4 at addr ffff00001125da70 by task B/672 CPU: 20 UID: 0 PID: 672 Comm: B Not tainted 7.1.0-rc6-00284-g8e65320d91cd #4 PREEMPT Hardware name: linux,dummy-virt (DT) Call trace: _raw_spin_lock+0xe4/0x1a0 binder_free_transaction+0x8c/0x320 binder_send_failed_reply+0x21c/0x2f8 binder_thread_release+0x488/0x7e0 binder_ioctl+0x12c0/0x29a0 [...] Allocated by task 675: __kmalloc_cache_noprof+0x174/0x444 binder_open+0x118/0xb70 do_dentry_open+0x374/0x1040 vfs_open+0x58/0x3bc [...] Freed by task 212: __kasan_slab_free+0x58/0x80 kfree+0x1a0/0x4a4 binder_proc_dec_tmpref+0x32c/0x5e0 binder_deferred_func+0xc48/0x104c process_one_work+0x53c/0xbc0 [...] ================================================================== To prevent this, pin the target thread (t->to_thread) to guarantee the target process remains alive. Undelivered transactions without a target thread are already safe, as the target process can only be the current context in those paths.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel binder driver contained a use-after-free vulnerability in the binder_free_transaction() function. Specifically, the target process pointer (t->to_proc) is read while holding the transaction lock (t->lock), but after releasing this lock, the target process can be freed concurrently. Subsequent attempts to acquire the inner lock of the freed process lead to a use-after-free error, as detected by KASAN. The vulnerability was addressed by pinning the target thread (t->to_thread) to guarantee the target process remains alive during the transaction freeing, preventing the UAF condition.
Potential Impact
This vulnerability can lead to kernel memory corruption due to use-after-free, potentially causing system crashes or instability. No specific exploitation details or active exploits are reported. The impact is limited to kernel-level memory safety and stability issues.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to address this vulnerability by pinning the target thread to ensure the target process remains alive during transaction freeing. Users should apply the official Linux kernel updates that include this fix. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor or Linux kernel advisories for the current remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-3g5w-3hx7-q6vh
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64468"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a6542079c2644c7f80829ec
Added to database: 07/25/2026, 23:08:55 UTC
Last enriched: 07/25/2026, 23:18:57 UTC
Last updated: 09/08/2026, 22:52:14 UTC
Views: 87
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.