CVE-2026-98778

What it actually does

Incorrect is_failure flag during binder transaction supersession causes binder_release_entire_buffer to treat stale FDA buffer contents as valid installed file descriptors, resulting in erroneous calls to binder_deferred_fd_close that close unrelated descriptors in the target process.

Why it matters to the business

Linux systems using the binder IPC mechanism may experience unexpected process failures, loss of open files or sockets, service disruptions, or potential escalation paths when async transactions are superseded, increasing operational risk on affected kernels.

How an attack unfolds

An attacker with local access crafts a TF_UPDATE_TXN binder transaction that supersedes a pending async transaction containing FDA objects. The kernel then invokes cleanup logic with the wrong flag, causing the system to interpret uninitialized buffer data as file descriptor numbers and close arbitrary descriptors belonging to the target process.

How to fix it

Update the Linux kernel to a version containing the fix for the is_failure flag handling in binder transaction cleanup paths. Rebuild and deploy the updated kernel across all affected systems; no configuration changes are required.

How to confirm the fix worked

Confirm the presence of the upstream commit that sets is_failure=true for superseded undelivered transactions in binder.c. Test by exercising TF_UPDATE_TXN supersession scenarios and verifying that no unrelated file descriptors are closed.

Typical attack path

1. Obtain local code execution or user context on a Linux system using binder.
2. Allocate and queue an async binder transaction containing BINDER_TYPE_FDA objects.
3. Send a superseding TF_UPDATE_TXN transaction before the original is delivered.
4. Trigger binder_release_entire_buffer with is_failure=false on the superseded buffer.
5. Observe or leverage the resulting closure of unrelated file descriptors in the target.

How to detect it

Review kernel logs for binder-related warnings or unexpected fd close events around transaction supersession; inspect process file descriptor tables post-transaction for unexplained closures; correlate with binder driver debug output if enabled.

What your security team should do

• Prioritize kernel updates on any systems exposing binder interfaces, especially Android-based or IPC-heavy workloads.
• Monitor vendor advisories for backported fixes in supported LTS kernels.
• Apply defense-in-depth by restricting untrusted local processes from binder communication where feasible.