SECUFOCUSNOW
Home›CVE index›CVE-2026-64469
Review reviewHigh

CVE-2026-64469

Linux

In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF in binder_thread_release() When a thread exits, binder_thread_release() walks its transaction stack to clear the t->from and t->to_proc that correspond with the exiting thread. However, a process dying in parallel might attempt to kfree some of these transactions. And if one of them has no associated t->to_proc, the t->to_proc->inner_lock will not be acquired. This means that transaction accesses in binder_thread_release() after t->to_proc has been cleared might race with binder_free_transaction() and cause...

CVSS
7.8
EPSS
-
- percentile
CISA KEV
Not listed
Published
2026.07.25
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability-
Technical severityCVSS 7.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF in binder_thread_release() When a thread exits, binder_thread_release() walks its transaction stack to clear the t->from and t->to_proc that correspond with the exiting thread. However, a process dying in parallel might attempt to kfree some of these transactions. And if one of them has no associated t->to_proc, the t->to_proc->inner_lock will not be acquired. This means that transaction accesses in binder_thread_release() after t->to_proc has been cleared might race with binder_free_transaction() and cause...

Affected product and versions

Product
Linux
Affected versions
>= 7a4408c6bd3eb1dafba67986259191be081e3efb < 1f96f8c0a6ed4f6d01d3dd29ad0cbf08dde96082, >= 7a4408c6bd3eb1dafba67986259191be081e3efb < df1a17abba8d6fac5f965adcb8113ceace6e4949, >= 7a4408c6bd3eb1dafba67986259191be081e3efb < 38e1a71728e5795b670cc159c18e286a40aeebb4, >= 7a4408c6bd3eb1dafba67986259191be081e3efb < faa070c7ad8ba25dcd0b12d7cdbb419e336f5391, >= 7a4408c6bd3eb1dafba67986259191be081e3efb < e63032dc715026a96bcaa13d375a8e15c91caa84, >= 7a4408c6bd3eb1dafba67986259191be081e3efb < ea02df466df60ecd758eb3b4df3f0cadc5c886ce, >= 7a4408c6bd3eb1dafba67986259191be081e3efb < ef5439ba5b9ac93349f5df12ef88b42a0ce26340, >= 7a4408c6bd3eb1dafba67986259191be081e3efb < 114a116aaa5f0295376cdf12da743c5bce3b20ce, >= 4.14
Fixed versions
No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
Not available
CVE-2026-64469 — Linux | SECUFOCUS NOW