Cloudanix VulnDB

CVE-2026-98777

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in how the Linux kernel cleans up certain internal messages can cause file references to pile up until the system can no longer open new files.

Exploitation
Other
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Other
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Direct kfree of an outdated binder transaction in the TF_UPDATE_TXN supersede path for frozen processes skips binder_free_txn_fixups, leaking binder_txn_fd_fixup entries and their pinned struct file references that accumulate across process lifetimes until file-max exhaustion.

Why it matters to the business

Repeated triggering in environments that rely on binder IPC can exhaust the system-wide file limit, causing widespread failures to open files or sockets and eventual denial of service that requires a reboot to recover.

How an attack unfolds

An attacker with local access crafts sequences of asynchronous binder transactions that are superseded while the target process is frozen; each supersede path leaks file references without ever decrementing them, gradually pinning objects in memory until the kernel can no longer allocate new files.

How to fix it

Apply the upstream kernel patch that inserts the missing binder_free_txn_fixups call before kfree in the t_outdated cleanup block; rebuild and deploy the fixed kernel image to all affected systems.

How to confirm the fix worked

Confirm the patch is present by inspecting the binder transaction cleanup code for the call to binder_free_txn_fixups immediately before kfree of the outdated transaction; test by exercising TF_UPDATE_TXN supersedes on frozen processes and verifying no growth in leaked file references.

Typical attack path

  1. Obtain local code execution or shell on a system using the binder driver
  2. Create pending async transactions in a process that can be frozen
  3. Repeatedly issue TF_UPDATE_TXN superseding transactions against the frozen target
  4. Monitor growth of open files or pinned struct file objects until file-max is reached
  5. Trigger system-wide failure to open new files or sockets

How to detect it

Search kernel logs and binder debug output for repeated transaction supersede events involving frozen processes; look for steady growth in open file counts or pinned struct file objects that persist after process termination; correlate with binder transaction activity in /sys/kernel/debug/binder.

What your security team should do

  • Prioritize patching Linux kernels that include the binder driver, especially on Android and embedded devices
  • Monitor file-max usage and struct file object counts on systems exposing binder interfaces
  • Restrict untrusted local code execution on systems until patches are applied

The record

In the Linux kernel, the following vulnerability has been resolved: binder: fix leaked fd fixups on TF_UPDATE_TXN supersede When a TF_UPDATE_TXN transaction supersedes a pending async transaction in a frozen process, the outdated transaction is freed with kfree() directly. This skips binder_free_txn_fixups(), leaking all binder_txn_fd_fixup entries and their fget()'d struct file references. The leaked file refcounts never reach zero, so the struct file objects are permanently pinned in memory. They survive process exit and accumulate across invocations until file-max exhaustion. Every other transaction cleanup path (binder_free_transaction(), binder_transaction() error paths, binder_release_work()) correctly calls binder_free_txn_fixups(). Add the missing call before kfree() in the t_outdated cleanup block.

Affected packages

Ecosystem Package Introduced Fixed