CVE-2026-98774: rust_binder: cancel deferred work items in thread exit
In the Linux kernel, the following vulnerability has been resolved:
rustbinder: cancel deferred work items in thread exit
If there are deferred work items on the thread todo list, then they are not cleaned up in the Thread::release() method. Thus, update the code to clean up the work items even if they are deferred.
This can happen if the thread dies while it has an active outgoing transaction.
Affected Software
Event History
Frequently Asked Questions
Under what condition can this issue occur?
It can occur when a thread exits while it has an active outgoing transaction and deferred work items remain on that thread's todo list.
What component and lifecycle path are involved?
The issue affects rust_binder handling during thread exit, specifically the Thread::release() cleanup path. Deferred work items on the thread todo list were not cleaned up there.
What is the remediation indicated by the available information?
Apply a Linux kernel version containing the rust_binder change that cancels deferred work items during thread exit. The provided references identify stable-kernel commits for the fix.