CVE-2026-64468: binder: fix UAF in binder_free_transaction()

In the Linux kernel, the following vulnerability has been resolved:

binder: fix UAF in binderfreetransaction()

In binderfreetransaction(), the t->toproc is read under the t->lock. However, once the t->lock is dropped, the toproc can die in parallel. This leads to a use-after-free error when we attempt to acquire its inner lock right afterwards:

================================================================== BUG: KASAN: slab-use-after-free in rawspinlock+0xe4/0x1a0 Write of size 4 at addr ffff00001125da70 by task B/672

CPU: 20 UID: 0 PID: 672 Comm: B Not tainted 7.1.0-rc6-00284-g8e65320d91cd #4 PREEMPT Hardware name: linux,dummy-virt (DT) Call trace: rawspinlock+0xe4/0x1a0 binderfreetransaction+0x8c/0x320 bindersendfailedreply+0x21c/0x2f8 binderthreadrelease+0x488/0x7e0 binderioctl+0x12c0/0x29a0 [...]

Allocated by task 675: kmalloccachenoprof+0x174/0x444 binderopen+0x118/0xb70 dodentryopen+0x374/0x1040 vfsopen+0x58/0x3bc [...]

Freed by task 212: kasanslabfree+0x58/0x80 kfree+0x1a0/0x4a4 binderprocdectmpref+0x32c/0x5e0 binderdeferredfunc+0xc48/0x104c processonework+0x53c/0xbc0 [...] ==================================================================

To prevent this, pin the target thread (t->tothread) to guarantee the target process remains alive. Undelivered transactions without a target thread are already safe, as the target process can only be the current context in those paths.