CVE-2026-23184: Linux Kernel Use-After-Free Vulnerability

CVE-2026-23184 Overview

CVE-2026-23184 is a Use-After-Free vulnerability in the Linux kernel's binder subsystem, specifically in the binder_netlink_report() function. The vulnerability occurs when oneway transactions are sent to frozen targets via binder_proc_transaction(). These transactions return a BR_TRANSACTION_PENDING_FROZEN error but are still treated as successful since the target is expected to thaw at some point. After this error, it becomes unsafe to access the transaction object 't' as it could have been consumed and freed by the now-thawed target process.

Critical Impact

This Use-After-Free vulnerability in the Linux kernel binder subsystem could allow local attackers to potentially execute arbitrary code or cause denial of service by exploiting improper memory access after transaction objects are freed.

Affected Products

• Linux kernel (binder subsystem)
• Android devices utilizing the binder IPC mechanism
• Systems running affected kernel versions with binder enabled

Discovery Timeline

• 2026-02-14 - CVE CVE-2026-23184 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-23184

Vulnerability Analysis

The vulnerability exists in the Android binder driver's netlink reporting functionality. When a binder transaction is sent to a frozen process, the kernel returns a BR_TRANSACTION_PENDING_FROZEN error code. However, the binder_netlink_report() function continues to dereference the transaction structure 't' after this error condition, even though the transaction may have already been consumed and freed by the target process once it thaws.

The KASAN (Kernel Address Sanitizer) report clearly identifies this as a slab-use-after-free condition with a read of size 8 at the freed memory address. The call trace shows the vulnerability occurring within binder_netlink_report.isra.0 during binder_transaction processing through the binder_ioctl path.

The memory allocation and deallocation pattern demonstrates the classic UAF scenario: the transaction object is allocated by task 522 during binder_transaction(), but freed by task 488 through binder_free_transaction() in binder_thread_read() before binder_netlink_report() attempts to access it.

Root Cause

The root cause is a race condition combined with improper lifetime management of transaction objects. When binder_proc_transaction() returns a BR_TRANSACTION_PENDING_FROZEN error, the code incorrectly assumes the transaction structure remains valid for subsequent operations. However, the frozen target may thaw and consume the transaction at any time, leading to the transaction being freed via binder_free_transaction() while binder_netlink_report() still holds a reference to it.

Attack Vector

The attack vector requires local access to the system. An attacker would need to:

1. Create a scenario where binder transactions are sent to a frozen process
2. Manipulate timing to cause the target process to thaw and consume the transaction
3. Trigger the binder_netlink_report() function to access the freed transaction memory

The exploitation involves manipulating binder transactions and process freeze/thaw states to create a race condition where memory is accessed after being freed. The freed memory could potentially be reallocated with attacker-controlled data, leading to information disclosure or code execution.

Detection Methods for CVE-2026-23184

Indicators of Compromise

• KASAN reports indicating slab-use-after-free in binder_netlink_report function
• Kernel crash logs with binder-related stack traces involving binder_transaction and binder_thread_write
• Anomalous binder IPC patterns involving rapid freeze/thaw operations

Detection Strategies

• Enable KASAN (Kernel Address Sanitizer) in kernel builds to detect use-after-free conditions at runtime
• Monitor kernel logs for binder subsystem errors and memory corruption warnings
• Deploy endpoint detection and response (EDR) solutions capable of monitoring kernel-level activities
• Use kernel debugging tools to trace binder transaction lifecycles

Monitoring Recommendations

• Configure syslog monitoring for kernel panic events related to binder operations
• Enable kernel debugging symbols and stack trace logging for binder subsystem
• Implement real-time monitoring of process freeze/thaw operations on critical systems
• Review audit logs for unusual binder IPC activity patterns

How to Mitigate CVE-2026-23184

Immediate Actions Required

• Update the Linux kernel to patched versions containing the fix
• Consider disabling non-essential binder functionality on affected systems until patched
• Enable KASAN during testing to identify potential exploitation attempts
• Monitor systems for signs of exploitation attempts

Patch Information

The fix involves making a transaction copy so the data can be safely accessed by binder_netlink_report() after a pending frozen error. The patch ensures that the original transaction object is not accessed after it may have been freed.

Official patches are available through the Linux kernel stable repositories:

• Kernel Git Commit 5e8a3d01544282e50d887d76f30d1496a0a53562
• Kernel Git Commit a6050dedb6f1cc23e518e3a132ab74a0aad6df90

Workarounds

• Apply kernel patches as the primary mitigation strategy
• Restrict access to binder device nodes to limit exposure surface
• Implement process isolation and sandboxing to contain potential exploitation
• For Android devices, apply OEM security updates when available

# Check current kernel version
uname -r

# Verify binder module status
lsmod | grep binder

# Monitor kernel logs for binder-related issues
dmesg | grep -i binder