CVE-2026-23184: Linux Kernel Use-After-Free Vulnerability

CVE-2026-23184 Overview

CVE-2026-23184 is a Use-After-Free vulnerability in the Linux kernel's binder subsystem, specifically in the binder_netlink_report() function. The vulnerability occurs when oneway transactions are sent to frozen targets via binder_proc_transaction(). These transactions return a BR_TRANSACTION_PENDING_FROZEN error but are still treated as successful since the target is expected to thaw at some point. After this error, it becomes unsafe to access the transaction object 't' as it could have been consumed and freed by the now-thawed target process.

Critical Impact
This Use-After-Free vulnerability in the Linux kernel binder subsystem could allow local attackers to potentially execute arbitrary code or cause denial of service by exploiting improper memory access after transaction objects are freed.

Affected Products

Linux kernel (binder subsystem)
Android devices utilizing the binder IPC mechanism
Systems running affected kernel versions with binder enabled

Discovery Timeline

2026-02-14 - CVE CVE-2026-23184 published to NVD
2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-23184

Vulnerability Analysis

The vulnerability exists in the Android binder driver's netlink reporting functionality. When a binder transaction is sent to a frozen process, the kernel returns a BR_TRANSACTION_PENDING_FROZEN error code. However, the binder_netlink_report() function continues to dereference the transaction structure 't' after this error condition, even though the transaction may have already been consumed and freed by the target process once it thaws.

The KASAN (Kernel Address Sanitizer) report clearly identifies this as a slab-use-after-free condition with a read of size 8 at the freed memory address. The call trace shows the vulnerability occurring within binder_netlink_report.isra.0 during binder_transaction processing through the binder_ioctl path.

The memory allocation and deallocation pattern demonstrates the classic UAF scenario: the transaction object is allocated by task 522 during binder_transaction(), but freed by task 488 through binder_free_transaction() in binder_thread_read() before binder_netlink_report() attempts to access it.

Root Cause

The root cause is a race condition combined with improper lifetime management of transaction objects. When binder_proc_transaction() returns a BR_TRANSACTION_PENDING_FROZEN error, the code incorrectly assumes the transaction structure remains valid for subsequent operations. However, the frozen target may thaw and consume the transaction at any time, leading to the transaction being freed via binder_free_transaction() while binder_netlink_report() still holds a reference to it.

Attack Vector

The attack vector requires local access to the system. An attacker would need to:

Create a scenario where binder transactions are sent to a frozen process
Manipulate timing to cause the target process to thaw and consume the transaction
Trigger the binder_netlink_report() function to access the freed transaction memory

The exploitation involves manipulating binder transactions and process freeze/thaw states to create a race condition where memory is accessed after being freed. The freed memory could potentially be reallocated with attacker-controlled data, leading to information disclosure or code execution.

Detection Methods for CVE-2026-23184

Indicators of Compromise

KASAN reports indicating slab-use-after-free in binder_netlink_report function
Kernel crash logs with binder-related stack traces involving binder_transaction and binder_thread_write
Anomalous binder IPC patterns involving rapid freeze/thaw operations

Detection Strategies

Enable KASAN (Kernel Address Sanitizer) in kernel builds to detect use-after-free conditions at runtime
Monitor kernel logs for binder subsystem errors and memory corruption warnings
Deploy endpoint detection and response (EDR) solutions capable of monitoring kernel-level activities
Use kernel debugging tools to trace binder transaction lifecycles

Monitoring Recommendations

Configure syslog monitoring for kernel panic events related to binder operations
Enable kernel debugging symbols and stack trace logging for binder subsystem
Implement real-time monitoring of process freeze/thaw operations on critical systems
Review audit logs for unusual binder IPC activity patterns

How to Mitigate CVE-2026-23184

Immediate Actions Required

Update the Linux kernel to patched versions containing the fix
Consider disabling non-essential binder functionality on affected systems until patched
Enable KASAN during testing to identify potential exploitation attempts
Monitor systems for signs of exploitation attempts

Patch Information

The fix involves making a transaction copy so the data can be safely accessed by binder_netlink_report() after a pending frozen error. The patch ensures that the original transaction object is not accessed after it may have been freed.

Official patches are available through the Linux kernel stable repositories:

Workarounds

Apply kernel patches as the primary mitigation strategy
Restrict access to binder device nodes to limit exposure surface
Implement process isolation and sandboxing to contain potential exploitation
For Android devices, apply OEM security updates when available

bash

# Check current kernel version
uname -r

# Verify binder module status
lsmod | grep binder

# Monitor kernel logs for binder-related issues
dmesg | grep -i binder