CVE-2021-47360

What it actually does

During BC_FREE_BUFFER processing in the binder driver, BINDER_TYPE_FDA object cleanup closes file descriptors via the task_work mechanism; without forcing the binder thread back to userspace the file objects may never be dereferenced, leaving processes hung.

Why it matters to the business

Systems may experience process hangs and resource leaks that degrade stability and availability, especially on Android or other binder-heavy workloads; the low exploit probability and lack of known campaigns reduce immediate operational urgency.

How an attack unfolds

An attacker with the ability to issue crafted binder transactions triggers BC_FREE_BUFFER handling that performs FDA cleanup; the missing return-to-userspace step leaves the thread blocked and file references unreleased, producing a denial-of-service condition.

How to fix it

Update the Linux kernel to a version containing the upstream commit that forces the binder thread back to userspace after fd closes during BC_FREE_BUFFER handling; apply distribution backports or rebuild with the fix if custom kernels are used.

How to confirm the fix worked

Confirm the presence of the fix by inspecting the binder driver source for the added task-work flush or userspace-return logic after FDA cleanup; test with synthetic binder workloads that close fds during BC_FREE_BUFFER and verify threads are not left hung.

Typical attack path

1. Obtain ability to communicate with a binder context
2. Craft and submit a BC_FREE_BUFFER transaction containing BINDER_TYPE_FDA objects
3. Trigger fd close operations that schedule task_work
4. Prevent or delay the binder thread's return to userspace to block dereference
5. Observe resulting hung processes and resource exhaustion

How to detect it

Look in kernel logs for binder-related warnings or hung-task messages around BC_FREE_BUFFER and FDA cleanup; correlate with process dumps showing threads blocked on file references; no public exploit artifacts are known.

What your security team should do

• Prioritize kernel updates on systems that heavily use binder (Android, certain embedded Linux)
• Monitor upstream stable branches and distribution advisories for the backported patch
• Apply defense-in-depth by restricting untrusted binder access where feasible