---
id: "CVE-2026-99075"
kind: "vulnerability"
aliases: ["CVE-2026-99075"]
title: "Linux kernel Rust Binder: dropped node refcount updates on thread exit"
severity: "unknown"
cvss: null
epss: 0.00206
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["android", "binder", "linux-kernel", "runtime"]
not_affected_if: []
published_at: "2026-10-23T13:17:31+00:00"
first_seen_at: "2026-10-23T21:57:34+00:00"
updated_at: "2026-10-25T12:38:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99075", "first_seen_at": "2026-10-23T21:57:34+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-99075", "first_seen_at": "2026-10-25T12:38:50+00:00"}]
---

# Linux kernel Rust Binder: dropped node refcount updates on thread exit

In the Linux kernel's Rust Binder driver, a thread exiting with BINDER_THREAD_EXIT could drop a pending node refcount increment, because cancelling pending work was a no-op. The result is a desynchronized node state where userspace is not notified and the node may never be freed.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99075
- 2026-10-25T12:38:50+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-99075

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

rust_binder: reschedule node refcount update on thread exit

When a thread exits via BINDER_THREAD_EXIT, its pending work items are
cancelled. If a thread exits while holding a pending node refcount
increment (e.g. pushed as deferred work to that thread), the refcount
increment was previously dropped because Node::cancel() and
NodeWrapper::cancel() were no-ops.

Dropping the refcount update leaves the node's delivery state and count
state desynchronized, and userspace will not receive the notification,
which can cause the node to never be freed from the process's nodes tree
when all external references are dropped.

Fix this by implementing DeliverToRead::cancel() for Node and NodeWrapper
to move the pending refcount update to the process's work queue on thread
exit so another thread can deliver it to userspace.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_