In the Linux kernel, the following vulnerability has been resolved: rust_binder: reschedule node refcount update on thread exit When a thread exits… (CVE-2026-99075)

The vulnerability in the Linux kernel rust_binder subsystem involved a race condition where a thread exiting with a pending node refcount increment would drop that increment because Node::cancel() and NodeWrapper::cancel() were no-ops. This led to desynchronization of the node's delivery and count states, causing userspace to miss notifications and potentially resulting in nodes never being freed from the process's nodes tree despite all external references being dropped. The issue was fixed by implementing DeliverToRead::cancel() for Node and NodeWrapper to move the pending refcount update to the process's work queue on thread exit, allowing another thread to deliver it to userspace.

The impact is that nodes in the rust_binder subsystem could remain allocated indefinitely due to missed notifications, leading to resource leakage in the kernel. This could degrade system stability or performance over time but does not directly indicate code execution or privilege escalation.

A fix has been implemented in the Linux kernel to address this issue by properly rescheduling the node refcount update on thread exit. Users should apply the official kernel update that includes this fix. Since no patch links or vendor advisories are provided here, users should consult the Linux kernel mailing lists or their distribution's security advisories for the official fix and update instructions.