CVE-2026-64469

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> binder: fix UAF in binder_thread_release()<br /> <br /> When a thread exits, binder_thread_release() walks its transaction stack<br /> to clear the t-&gt;from and t-&gt;to_proc that correspond with the exiting<br /> thread. However, a process dying in parallel might attempt to kfree some<br /> of these transactions. And if one of them has no associated t-&gt;to_proc,<br /> the t-&gt;to_proc-&gt;inner_lock will not be acquired.<br /> <br /> This means that transaction accesses in binder_thread_release() after<br /> t-&gt;to_proc has been cleared might race with binder_free_transaction()<br /> and cause a use-after-free error as reported by KASAN:<br /> <br /> ==================================================================<br /> BUG: KASAN: slab-use-after-free in binder_thread_release+0x5d0/0x798<br /> Write of size 8 at addr ffff000016627500 by task X/715<br /> <br /> CPU: 17 UID: 0 PID: 715 Comm: X Not tainted 7.1.0-rc5-00149-g8fde5d1d47f6 #30 PREEMPT<br /> Hardware name: linux,dummy-virt (DT)<br /> Call trace:<br /> binder_thread_release+0x5d0/0x798<br /> binder_ioctl+0x12c0/0x299c<br /> [...]<br /> <br /> Allocated by task 717 on cpu 18 at 67.267803s:<br /> __kasan_kmalloc+0xa0/0xbc<br /> __kmalloc_cache_noprof+0x174/0x444<br /> binder_transaction+0x554/0x8150<br /> binder_thread_write+0xa30/0x4354<br /> binder_ioctl+0x20f0/0x299c<br /> [...]<br /> <br /> Freed by task 202 on cpu 18 at 90.416221s:<br /> __kasan_slab_free+0x58/0x80<br /> kfree+0x1a0/0x4a4<br /> binder_free_transaction+0x150/0x294<br /> binder_send_failed_reply+0x398/0x6d8<br /> binder_release_work+0x3e4/0x4ec<br /> binder_deferred_func+0xbd8/0x104c<br /> [...]<br /> ==================================================================<br /> <br /> In order to avoid this, make sure that binder_free_transaction() reads<br /> the t-&gt;to_proc under the transaction lock. This will serialize the<br /> transaction release with the accesses in binder_thread_release(). Plus,<br /> it matches the documented locking rules for @to_proc.