The Linux kernel binder driver contained a use-after-free vulnerability in the binder_free_transaction() function. Specifically, the target process pointer (t->to_proc) is read while holding the transaction lock (t->lock), but after releasing this lock, the target process can be freed concurrently. Subsequent attempts to acquire the inner lock of the freed process lead to a use-after-free error, as detected by KASAN. The vulnerability was addressed by pinning the target thread (t->to_thread) to guarantee the target process remains alive during the transaction freeing, preventing the UAF condition.

This vulnerability can lead to kernel memory corruption due to use-after-free, potentially causing system crashes or instability. No specific exploitation details or active exploits are reported. The impact is limited to kernel-level memory safety and stability issues.

A fix has been implemented in the Linux kernel to address this vulnerability by pinning the target thread to ensure the target process remains alive during transaction freeing. Users should apply the official Linux kernel updates that include this fix. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor or Linux kernel advisories for the current remediation guidance.