CVE-2026-98778: binder: fix is_failure flag for superseded transaction cleanup
binder: fix isfailure flag for superseded transaction cleanup
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.10-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.113 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.56 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
Event History
Frequently Asked Questions
What conditions are required for the issue to occur?
A Binder TF_UPDATE_TXN transaction must supersede a pending asynchronous transaction. The superseded transaction must contain BINDER_TYPE_FDA data, because its cleanup path can treat stale buffer contents as file descriptor numbers.
What is the practical impact of the flawed cleanup?
The target process can have unrelated file descriptors closed. This occurs because the cleanup handler may defer closure of descriptor numbers read from stale buffer contents even though no descriptors from the undelivered transaction were installed.
How does the fix prevent the unintended descriptor closures?
The fix calls binder_release_entire_buffer() with is_failure=true for the superseded, undelivered transaction. This makes cleanup follow the failure semantics used by other undelivered-transaction paths rather than treating stale data as installed descriptors.