In the Linux kernel, the following vulnerability has been resolved: binderfs: fix UAF write in binder_add_device binderfs_binder_device_create()… (CVE-2026-98776)

The vulnerability in the Linux kernel's binderfs arises from a race condition between publishing a new device dentry and registering it in the global binder_devices list. After simple_done_creating() releases the parent directory lock and drops the creator's dentry reference, a concurrent unlinkat() can remove the device entry, triggering binderfs_evict_inode() to free the device. Later, binder_add_device() accesses this freed object, resulting in a use-after-free write. This was detected by KASAN during testing with a modified Syzkaller tool.

This vulnerability allows a use-after-free write in kernel memory, which can lead to kernel memory corruption. While the exact exploitation impact is not detailed, such conditions can potentially cause system crashes or privilege escalation if exploited.

A fix for this vulnerability has been implemented in the Linux kernel. Users and administrators should apply the official kernel updates that include this patch to remediate the issue. Patch status is not explicitly stated in the input data, so verify with the vendor advisory for the exact fixed kernel versions.