{"id":"CVE-2026-98776","kind":"vulnerability","aliases":["CVE-2026-98776"],"related":[],"title":"Linux kernel: binderfs race lets a concurrent unlink cause use-after-free write","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbinderfs: fix UAF write in binder_add_device\n\nbinderfs_binder_device_create() publishes the new dentry with\nd_make_persistent() and then calls simple_done_creating(), which drops\nthe parent directory lock and the creator's dentry reference. It then\ncalls binder_add_device() to register the device in the global\nbinder_devices list.\n\nAfter simple_done_creating() releases the parent directory lock, a\nconcurrent unlinkat() can remove the new device entry. Dropping the\ncreator's dentry reference can then trigger binderfs_evict_inode(),\nfreeing the device. binder_add_device() later accesses the freed\nobject, causing UAF write.\n\nFound by a modified Syzkaller:\n\n\tBUG: KASAN: slab-use-after-free in hlist_add_head include/linux/list.h:1073 [inline]\n\tBUG: KASAN: slab-use-after-free in binder_add_device+0xa9/0xc0 drivers/android/binder.c:7068\n\tWrite of size 8 at addr ffff88805b340c00 by task syz.1.532/11389\n\n\tCPU: 0 UID: 0 PID: 11389 Comm: syz.1.532 Not tainted 7.2.0 #4 PREEMPT(full)\n\tHardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n\tCall Trace:\n\t<TASK>\n\t__dump_stack lib/dump_stack.c:94 [inline]\n\tdump_stack_lvl+0x10e/0x1f0 lib/dump_stack.c:120\n\tprint_address_description mm/kasan/report.c:378 [inline]\n\tprint_report+0xf7/0x600 mm/kasan/report.c:482\n\tkasan_report+0xe4/0x120 mm/kasan/report.c:595\n\thlist_add_head include/linux/list.h:1073 [inline]\n\tbinder_add_device+0xa9/0xc0 drivers/android/binder.c:7068\n\tbinderfs_binder_device_create.isra.0+0x724/0x990 drivers/android/binderfs.c:196\n\tbinder_ctl_ioctl+0x186/0x1b0 drivers/android/binderfs.c:241\n\tvfs_ioctl fs/ioctl.c:51 [inline]\n\t__do_sys_ioctl fs/ioctl.c:597 [inline]\n\t__se_sys_ioctl fs/ioctl.c:583 [inline]\n\t__x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583\n\tdo_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n\tdo_syscall_64+0x116/0x800 arch/x86/entry/syscall_64.c:94\n\tentry_SYSCALL_64_after_hwframe+0x77/0x7f\n\tRIP: 0033:0x7ff9027a833d\n\tCode: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48\n\tRSP: 002b:00007ff903674018 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\n\tRAX: ffffffffffffffda RBX: 00007ff902a35fa0 RCX: 00007ff9027a833d\n\tRDX: 0000200000000500 RSI: 00000000c1086201 RDI: 0000000000000004\n\tRBP: 00007ff902850733 R08: 0000000000000000 R09: 0000000000000000\n\tR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\n\tR13: 00007ff902a36038 R14: 00007ff902a35fa0 R15: 00007ffd7166bfa0\n\t</TASK>\n\n\tAllocated by task 11389:\n\tkasan_save_stack+0x33/0x60 mm/kasan/common.c:57\n\tkasan_save_track+0x14/0x30 mm/kasan/common.c:78\n\tpoison_kmalloc_redzone mm/kasan/common.c:398 [inline]\n\t__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415\n\tkasan_kmalloc include/linux/kasan.h:263 [inline]\n\t__kmalloc_cache_noprof+0x2e4/0x6f0 mm/slub.c:5489\n\t_kmalloc_noprof include/linux/slab.h:988 [inline]\n\t_kzalloc_noprof include/linux/slab.h:1309 [inline]\n\tbinderfs_binder_device_create.isra.0+0x17a/0x990 drivers/android/binderfs.c:148\n\tbinder_ctl_ioctl+0x186/0x1b0 drivers/android/binderfs.c:241\n\tvfs_ioctl fs/ioctl.c:51 [inline]\n\t__do_sys_ioctl fs/ioctl.c:597 [inline]\n\t__se_sys_ioctl fs/ioctl.c:583 [inline]\n\t__x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583\n\tdo_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n\tdo_syscall_64+0x116/0x800 arch/x86/entry/syscall_64.c:94\n\tentry_SYSCALL_64_after_hwframe+0x77/0x7f\n\n\tFreed by task 11389:\n\tkasan_save_stack+0x33/0x60 mm/kasan/common.c:57\n\tkasan_save_track+0x14/0x30 mm/kasan/common.c:78\n\tkasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:584\n\tpoison_slab_object mm/kasan/common.c:253 [inline]\n\t__kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285\n\tkasan_slab_free include/linux/kasan.h:235 [inline]\n\tslab_free_hook mm/slub.c:2677 [inline]\n\tslab_free mm/slub.c:6377 [inline]\n\tkfree+0x2fc/0x6e0 mm/slub.c:6692\n\tbinderf\n---truncated---","summary":"In binderfs, a Binder device is published before it is fully registered, so a concurrent unlinkat() can free it while the kernel still writes to it. The sources describe a use-after-free write in binder_add_device, which can corrupt kernel memory.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","binderfs","infrastructure","linux-kernel"],"not_affected_if":["binderfs-not-mounted"],"how_to_check":"- Run `uname -r` and compare against the fixed kernel builds listed in the NVD entry.\n- Check whether binderfs is mounted with `mount | grep binder`; unknown if the sources give no other check.","fix":"- Update the Linux kernel to a release that includes the upstream binderfs fix (version unknown from the sources).\n- Until patched, unload or avoid mounting binderfs where it is not needed (unknown from the sources).","status":"open","published_at":"2026-10-18T16:17:31+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:15:27+00:00","updated_at":"2026-10-25T05:15:27+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:15:27Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream binderfs fix (version unknown from the sources).\n- Until patched, unload or avoid mounting binderfs where it is not needed (unknown from the sources).","reach":"local","title":"Linux kernel: binderfs race lets a concurrent unlink cause use-after-free write","impact":"high","summary":"In binderfs, a Binder device is published before it is fully registered, so a concurrent unlinkat() can free it while the kernel still writes to it. The sources describe a use-after-free write in binder_add_device, which can corrupt kernel memory.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","binderfs","android"],"confidence":0.5,"needs_auth":"unknown","worst_case":"local code can corrupt kernel memory and possibly escalate privileges","analyst_note":"Check the NVD entry and the upstream kernel commit for affected version ranges, a fixed version, and whether unprivileged users can reach binderfs.","how_to_check":"- Run `uname -r` and compare against the fixed kernel builds listed in the NVD entry.\n- Check whether binderfs is mounted with `mount | grep binder`; unknown if the sources give no other check.","needs_analyst":true,"not_affected_if":["binderfs-not-mounted"],"who_is_affected":"Systems that run the Linux kernel with binderfs enabled, typically Android-derived environments or hosts that use Binder IPC. Hosts that do not load or mount binderfs are unlikely to be exposed; the sources do not say more.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000843,"input_tokens":5498,"output_tokens":587,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':209C,266C,278C,284C,297C,303C,310C,334C,347C,356C,471C,478C,490C,502C,518C,525C,549C,562C,571C,580C,587C,595C,608C,630C '-2':254C '-2026':16A,19A '-98776':17A,20A '0':224C,226C,302C,517C '00':369C,370C,371C,372C,373C '0000000000000000':449C,451C,453C,457C '0000000000000004':445C '0000000000000010':433C '0000000000000246':455C '00000000c1086201':443C '00000246':430C '0000200000000500':441C '00007ff9027a833d':439C '00007ff902850733':447C '00007ff902a35fa0':437C,461C '00007ff902a36038':459C '00007ff903674018':428C '00007ffd7166bfa0':463C '002b':427C '0033':359C '01':406C,411C,424C '04/01/2014':255C '05':403C '08':401C '0f':366C,376C,402C '0x7ff9027a833d':360C '1.16.3':251C,253C '1073':196C,292C '11389':228C,467C,576C '120':269C '1309':514C '148':521C '196':306C '1996':249C '1e':377C '1f':367C '235':616C '24':400C '24.04':241C '241':313C,528C '253':603C '263':497C '2677':622C '285':611C '2e':365C '378':274C '398':486C '3d':405C '4':234C '415':493C '48':379C,382C,385C,388C,404C,413C,425C '482':281C '4c':397C,399C '4d':391C,394C '51':317C,532C '5489':505C '57':474C,583C '583':329C,337C,544C,552C '584':598C '595':287C '597':323C,538C '63':342C,557C '6377':627C '64':346C,353C,422C,561C,568C '66':364C '6692':633C '7.2.0':233C '7068':212C,300C '73':410C '78':481C,590C '8':216C '84':368C '89':380C,383C,386C,389C,392C,395C,423C '8b':398C '90':374C '94':261C,350C,565C '988':509C 'access':172C 'add':64B,87C,123C,169C,193C,207C,289C,295C 'addr':218C 'address':271C 'alloc':464C 'android':21B 'arch':246C 'arch/x86/entry/syscall_64.c':341C,349C,556C,564C 'b0':416C 'binder':30B,63B,86C,90C,122C,132C,168C,206C,294C,307C,522C 'binderf':3A,22B,28B,81C,89C,162C,634C 'binderfs_binder_device_create.isra':301C,516C 'bio':250C 'bug':184C,198C 'c1':415C 'c2':393C 'c3':363C,412C 'c7':414C 'c8':396C 'ca':390C 'cach':500C 'call':103C,121C,256C 'cap':247C 'caus':9A,176C 'code':361C 'comm':229C 'concurr':7A,41B,145C 'corrupt':68B 'cpu':223C 'creat':92C,106C,138C 'creator':115C,155C 'ctl':308C,523C 'cve':15A,18A 'd':98C 'd6':387C 'd8':421C 'debian':252C 'dentri':96C,117C,157C 'describ':55B 'descript':272C 'devic':31B,65B,88C,91C,124C,128C,133C,151C,167C,170C,208C,296C 'directori':111C,142C 'done':105C,137C 'drivers/android/binder.c':211C,299C 'drivers/android/binderfs.c':305C,312C,520C,527C 'drop':108C,153C 'dump':258C,263C 'eflag':429C 'entri':152C,351C,566C 'evict':163C 'f0':407C 'f3':375C 'f7':384C,420C 'f8':381C 'fa':378C 'ff':362C,408C,409C,417C,418C,419C 'ffff88805b340c00':219C 'ffffffffffffffda':435C 'fix':82C,248C 'follow':76C 'found':179C 'free':13A,44B,60B,165C,190C,204C,593C,607C,614C,619C,625C 'freed':174C,573C 'fs/ioctl.c':316C,322C,328C,336C,531C,537C,543C,551C 'full':236C 'fulli':37B 'global':131C 'hardwar':237C 'head':194C,290C 'hlist':192C,288C 'hook':620C 'hwframe':355C,570C 'i440fx':244C 'include/linux/kasan.h':496C,615C 'include/linux/list.h':195C,291C 'include/linux/slab.h':508C,513C 'info':594C 'infrastructur':23B 'inlin':197C,262C,275C,293C,318C,324C,330C,343C,487C,498C,510C,515C,533C,539C,545C,558C,604C,617C,623C,628C 'inod':164C 'ioctl':309C,315C,321C,327C,333C,524C,530C,536C,542C,548C 'kasan':185C,199C,282C,468C,475C,488C,494C,577C,584C,591C,605C,612C 'kernel':2A,26B,48B,69B,74C 'kfree':629C 'kmalloc':483C,489C,495C,499C,506C 'kzalloc':511C 'later':171C 'let':5A 'lib/dump_stack.c':260C,268C 'linux':1A,25B,73C 'linux-kernel':24B 'list':134C 'lock':112C,143C 'lvl':265C 'make':99C 'memori':70B 'mm/kasan/common.c':473C,480C,485C,492C,582C,589C,602C,610C 'mm/kasan/generic.c':597C 'mm/kasan/report.c':273C,280C,286C 'mm/slub.c':504C,621C,626C,632C 'modifi':182C 'name':238C 'new':95C,150C 'noprof':501C,507C,512C 'object':175C,601C 'orig':431C 'parent':110C,141C 'pc':242C 'persist':100C 'pid':227C 'piix':245C 'poison':482C,599C 'preempt':235C 'print':270C,276C 'publish':33B,93C 'qemu':239C 'r08':448C 'r09':450C 'r10':452C 'r11':454C 'r12':456C 'r13':458C 'r14':460C 'r15':462C 'race':4A 'rax':432C,434C 'rbp':446C 'rbx':436C 'rcx':438C 'rdi':444C 'rdx':440C 'redzon':484C 'refer':118C,158C 'regist':38B,126C 'releas':139C 'remov':148C 'report':277C,283C 'resolv':80C 'rip':358C 'rsi':442C 'rsp':426C 'save':469C,476C,578C,585C,592C 'se':325C,540C 'simpl':104C,136C 'size':215C 'slab':187C,201C,600C,606C,613C,618C,624C 'slab-use-after-fre':186C,200C 'sourc':54B 'stack':259C,264C,470C,579C 'still':49B 'sys':320C,326C,332C,535C,541C,547C 'syscal':339C,345C,352C,554C,560C,567C 'syz.1.532':230C 'syz.1.532/11389':222C 'syzkal':183C 'taint':232C 'task':221C,466C,575C 'trace':257C 'track':477C,586C 'trigger':161C 'truncat':635C 'uaf':83C,177C 'ubuntu':240C 'uid':225C 'unlink':8A 'unlinkat':42B,146C 'use':11A,58B,188C,202C 'use-after-fre':10A,57B 'v2':243C 'vfs':314C,529C 'vulner':77C 'write':14A,50B,61B,84C,178C,213C 'x10e/0x1f0':267C 'x116/0x800':348C,563C 'x14/0x30':479C,588C 'x17a/0x990':519C 'x186/0x1b0':311C,526C 'x18e/0x210':335C,550C 'x2e4/0x6f0':503C 'x2fc/0x6e0':631C 'x33/0x60':472C,581C 'x3b/0x60':596C 'x5f/0x80':609C 'x64':331C,340C,546C,555C 'x724/0x990':304C 'x77/0x7f':357C,572C 'xa9/0xc0':210C,298C 'xaa/0xb0':491C 'xe4/0x120':285C 'xf7/0x600':279C","nicknames":[],"mitigations":[],"who_affected":"Systems that run the Linux kernel with binderfs enabled, typically Android-derived environments or hosts that use Binder IPC. Hosts that do not load or mount binderfs are unlikely to be exposed; the sources do not say more.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:31+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98776","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98776","severity":null,"published_at":"2026-10-18T16:17:31+00:00","modified_at":"2026-10-19T10:19:41+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}