{"id":"CVE-2026-98774","kind":"vulnerability","aliases":["CVE-2026-98774"],"related":[],"title":"Linux kernel: Rust Binder leaves deferred work items uncleaned on thread exit","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nrust_binder: cancel deferred work items in thread exit\n\nIf there are deferred work items on the thread todo list, then they are\nnot cleaned up in the Thread::release() method. Thus, update the code to\nclean up the work items even if they are deferred.\n\nThis can happen if the thread dies while it has an active outgoing\ntransaction.","summary":"In the Rust Binder driver, deferred work items on a thread's todo list are not cleaned up when the thread exits, which can happen if the thread dies during an outgoing transaction. The sources describe a resource-cleanup flaw and do not state what an attacker gains from it.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","infrastructure","linux-kernel","rust-binder"],"not_affected_if":[],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-18T16:17:31+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:15:26+00:00","updated_at":"2026-10-25T05:15:26+00:00","category":"infrastructure","confidence":0.3,"triage":{"at":"2026-10-25T05:15:26Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"Linux kernel: Rust Binder leaves deferred work items uncleaned on thread exit","impact":"low","summary":"In the Rust Binder driver, deferred work items on a thread's todo list are not cleaned up when the thread exits, which can happen if the thread dies during an outgoing transaction. The sources describe a resource-cleanup flaw and do not state what an attacker gains from it.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","rust-binder","android"],"confidence":0.3,"needs_auth":"unknown","worst_case":"unknown","analyst_note":"Check the kernel.org stable commit and the NVD entry for affected kernel versions, whether rust_binder is enabled by default, and the security impact.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Systems running a Linux kernel built with the rust_binder driver are the ones to look at; the sources do not say which kernel versions or configurations include it. unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000538,"input_tokens":3337,"output_tokens":409,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-98774':15A,18A 'activ':143C 'android':19B 'attack':74B 'binder':4A,26B,30B,87C 'cancel':88C 'clean':43B,110C,122C 'cleanup':66B 'code':120C 'cve':13A,16A 'defer':6A,32B,89C,98C,131C 'describ':62B 'die':55B,138C 'driver':31B 'even':127C 'exit':12A,48B,94C 'flaw':67B 'follow':81C 'gain':75B 'happen':51B,134C 'infrastructur':20B 'item':8A,34B,91C,100C,126C 'kernel':2A,23B,79C 'leav':5A 'linux':1A,22B,78C 'linux-kernel':21B 'list':40B,105C 'method':116C 'outgo':58B,144C 'releas':115C 'resolv':85C 'resourc':65B 'resource-cleanup':64B 'rust':3A,25B,29B,86C 'rust-bind':24B 'sourc':61B 'state':71B 'thread':11A,37B,47B,54B,93C,103C,114C,137C 'thus':117C 'todo':39B,104C 'transact':59B,145C 'unclean':9A 'updat':118C 'vulner':82C 'work':7A,33B,90C,99C,125C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel built with the rust_binder driver are the ones to look at; the sources do not say which kernel versions or configurations include it. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:31+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98774","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98774","severity":null,"published_at":"2026-10-18T16:17:31+00:00","modified_at":"2026-10-19T10:19:41+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}