Live › vulnerability › CVE-2026-98777
Go to dashboardWhen a binder transaction is superseded in a frozen process, its file descriptor fixup entries are freed without releasing their file references. The leaked struct file objects stay pinned after process exit and can accumulate until the system runs out of file handles.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with the binder IPC driver in use, such as Android devices and anything that uses binder with frozen processes. The sources do not say which kernel versions are affected or which configurations are common.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
binder: fix leaked fd fixups on TF_UPDATE_TXN supersede
When a TF_UPDATE_TXN transaction supersedes a pending async transaction in a frozen process, the outdated transaction is freed with kfree() directly. This skips binder_free_txn_fixups(), leaking all binder_txn_fd_fixup entries and their fget()'d struct file references.
The leaked file refcounts never reach zero, so the struct file objects are permanently pinned in memory. They survive process exit and accumulate across invocations until file-max exhaustion.
Every other transaction cleanup path (binder_free_transaction(), binder_transaction() error paths, binder_release_work()) correctly calls binder_free_txn_fixups(). Add the missing call before kfree() in the t_outdated cleanup block.
This page as .md · .json · in your agent: get_signal("CVE-2026-98777")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.