{"id":"CVE-2026-98777","kind":"vulnerability","aliases":["CVE-2026-98777"],"related":[],"title":"Linux kernel: binder leaks file references when superseding frozen transactions","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbinder: fix leaked fd fixups on TF_UPDATE_TXN supersede\n\nWhen a TF_UPDATE_TXN transaction supersedes a pending async transaction\nin a frozen process, the outdated transaction is freed with kfree()\ndirectly. This skips binder_free_txn_fixups(), leaking all\nbinder_txn_fd_fixup entries and their fget()'d struct file references.\n\nThe leaked file refcounts never reach zero, so the struct file objects\nare permanently pinned in memory. They survive process exit and\naccumulate across invocations until file-max exhaustion.\n\nEvery other transaction cleanup path (binder_free_transaction(),\nbinder_transaction() error paths, binder_release_work()) correctly\ncalls binder_free_txn_fixups(). Add the missing call before kfree()\nin the t_outdated cleanup block.","summary":"When a binder transaction is superseded in a frozen process, its file descriptor fixup entries are freed without releasing their file references. The leaked struct file objects stay pinned after process exit and can accumulate until the system runs out of file handles.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","binder","linux-kernel","runtime"],"not_affected_if":["binder-not-in-use"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-18T16:17:31+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:15:25+00:00","updated_at":"2026-10-25T05:15:25+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T05:15:25Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: binder leaks file references when superseding frozen transactions","impact":"low","summary":"When a binder transaction is superseded in a frozen process, its file descriptor fixup entries are freed without releasing their file references. The leaked struct file objects stay pinned after process exit and can accumulate until the system runs out of file handles.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","binder","android"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Resource exhaustion from leaked file handles until file-max is reached","analyst_note":"Find the upstream kernel commit and affected/fixed version ranges from the NVD entry or kernel.org stable tree to fill in how_to_check and fix.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["binder-not-in-use"],"who_is_affected":"Systems running a Linux kernel with the binder IPC driver in use, such as Android devices and anything that uses binder with frozen processes. The sources do not say which kernel versions are affected or which configurations are common.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000567,"input_tokens":3524,"output_tokens":430,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98777':13A,16A 'accumul':57B,151C 'across':152C 'add':180C 'android':17B 'async':95C 'binder':3A,18B,25B,76C,111C,117C,164C,167C,171C,176C 'block':191C 'call':175C,183C 'cleanup':162C,190C 'correct':174C 'cve':11A,14A 'd':125C 'descriptor':35B 'direct':108C 'entri':37B,121C 'error':169C 'everi':159C 'exhaust':158C 'exit':54B,149C 'fd':79C,119C 'fget':124C 'file':5A,34B,43B,48B,64B,127C,131C,139C,156C 'file-max':155C 'fix':77C 'fixup':36B,80C,114C,120C,179C 'follow':71C 'free':112C,165C,177C 'freed':39B,105C 'frozen':9A,31B,99C 'handl':65B 'invoc':153C 'kernel':2A,21B,69C 'kfree':107C,185C 'leak':4A,46B,78C,115C,130C 'linux':1A,20B,68C 'linux-kernel':19B 'max':157C 'memori':145C 'miss':182C 'never':133C 'object':49B,140C 'outdat':102C,189C 'path':163C,170C 'pend':94C 'perman':142C 'pin':51B,143C 'process':32B,53B,100C,148C 'reach':134C 'refcount':132C 'refer':6A,44B,128C 'releas':41B,172C 'resolv':75C 'run':61B 'runtim':22B 'skip':110C 'stay':50B 'struct':47B,126C,138C 'supersed':8A,28B,85C,92C 'surviv':147C 'system':60B 'tf':82C,88C 'transact':10A,26B,91C,96C,103C,161C,166C,168C 'txn':84C,90C,113C,118C,178C 'updat':83C,89C 'vulner':72C 'without':40B 'work':173C 'zero':135C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the binder IPC driver in use, such as Android devices and anything that uses binder with frozen processes. The sources do not say which kernel versions are affected or which configurations are common.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:31+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98777","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98777","severity":null,"published_at":"2026-10-18T16:17:31+00:00","modified_at":"2026-10-21T13:21:45+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}