CVE-2026-98777: binder: fix leaked fd fixups on TF_UPDATE_TXN supersede
binder: fix leaked fd fixups on TFUPDATETXN supersede
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.10-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.113 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.56 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Compensating control
In the Linux kernel binder t_outdated cleanup block, call binder_free_txn_fixups() before kfree() to release binder_txn_fd_fixup entries and their fget()'d struct file references.
Event History
Frequently Asked Questions
What conditions are required for the leak to occur?
A TF_UPDATE_TXN transaction must supersede a pending asynchronous transaction in a frozen process. The affected outdated transaction must include file-descriptor fixups, whose referenced struct file objects are not released during that cleanup path.
What is the operational impact of repeated exploitation or triggering?
Each occurrence can permanently retain struct file references. These references survive process exit and can accumulate across invocations until the system reaches file-max exhaustion.
How can administrators determine whether a system may be affected?
The issue is relevant where Binder transactions using TF_UPDATE_TXN can supersede pending asynchronous transactions in frozen processes. The provided data does not include affected kernel version ranges or a runtime indicator for confirming accumulated leaked references.
What remediation is described?
The resolved change calls binder_free_txn_fixups() before kfree() in the t_outdated cleanup block, ensuring binder_txn_fd_fixup entries and their fget()'d file references are released.