CVE-2026-98778binder: fix is_failure flag for superseded transaction cleanup
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: binder: fix is_failure flag for superseded transaction cleanup When a TF_UPDATE_TXN transaction supersedes a pending async transaction, binder_release_entire_buffer() is called with is_failure=false. Since the superseded transaction was never delivered, binder_apply_fd_fixups() was never called and no fds were installed in the target process. With is_failure=false, the BINDER_TYPE_FDA cleanup handler interprets stale buffer contents as installed fd numbers and passes them to binder_deferred_fd_close(), closing unrelated file descriptors. Pass is_failure=true since the transaction was never delivered to the target, matching the semantics of all other undelivered-transaction cleanup paths.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 18, 2026
- First seen by InfoSec Signals
- Oct 18, 2026
Affected products
Linux Linux linux:linux (from the name) | 9864bb4801331daa48514face9d0f4861e4d485b builds before 60a9f7323ae7318a7cce0d387c318da24f1e8726; 9864bb4801331daa48514face9d0f4861e4d485b builds before 86cdcc87d4ba60aebf94ba3346b3c900c5cd79ff; 9864bb4801331daa48514face9d0f4861e4d485b builds before 1ab671b50714ad8e359cf37eb041d8044319ccdc; 9864bb4801331daa48514face9d0f4861e4d485b builds before 22c135635fdd9816c0ef140d6de7b2e4fdf73e89 | CNA record |
References
- https://git.kernel.org/stable/c/60a9f7323ae7318a7cce0d387c318da24f1e8726
- https://git.kernel.org/stable/c/86cdcc87d4ba60aebf94ba3346b3c900c5cd79ff
- https://git.kernel.org/stable/c/1ab671b50714ad8e359cf37eb041d8044319ccdc
- https://git.kernel.org/stable/c/22c135635fdd9816c0ef140d6de7b2e4fdf73e89
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.