CVE-2026-64468: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64468 Overview

CVE-2026-64468 is a use-after-free (UAF) vulnerability in the Linux kernel's Binder inter-process communication (IPC) driver. The flaw resides in the binder_free_transaction() function, where the target process pointer t->to_proc is read under t->lock, but the lock is then dropped before the code attempts to acquire the target's inner lock. During this window, the target process can be freed in parallel, leaving a dangling pointer that is subsequently dereferenced.

Binder is used extensively on Android and Linux systems for IPC between processes and services. A local attacker with the ability to open /dev/binder and issue crafted ioctl calls can trigger the race and corrupt kernel memory.

Critical Impact
Local attackers can trigger memory corruption in the Linux kernel through Binder IPC, potentially leading to privilege escalation, denial of service, or arbitrary kernel code execution.

Affected Products

Linux kernel versions containing the pre-patch binder_free_transaction() implementation
Android distributions built on affected Linux kernel branches
Downstream Linux distributions shipping the vulnerable Binder driver

Discovery Timeline

2026-07-25 - CVE-2026-64468 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64468

Vulnerability Analysis

The vulnerability is a classic use-after-free race condition in the Binder driver's transaction cleanup path. binder_free_transaction() reads the target process pointer t->to_proc while holding t->lock. After releasing the lock, the code attempts to acquire the target process's inner spinlock. Between the lock release and the acquisition, another thread can drop the last temporary reference on the target process via binder_proc_dec_tmpref(), causing kfree() on the binder_proc structure.

Kernel Address Sanitizer (KASAN) reports confirm the pattern with a slab-use-after-free in _raw_spin_lock triggered from the binder_free_transaction → binder_send_failed_reply → binder_thread_release → binder_ioctl call chain. The write occurs when the spinlock word inside the freed binder_proc is modified.

Because the corruption happens on freed slab memory, an attacker who wins the race can influence which object is reallocated in that slot, enabling controlled kernel memory corruption.

Root Cause

The root cause is insufficient reference-count protection on t->to_proc outside of t->lock. The Binder driver assumed the target process would remain valid across the lock boundary, but no temporary reference (tmpref) was pinned before dropping the lock. The upstream fix pins the target thread t->to_thread first, which transitively keeps the target process alive during inner lock acquisition.

Attack Vector

Exploitation requires local access and the ability to interact with the Binder driver. An unprivileged process opens /dev/binder, issues BINDER_WRITE_READ ioctls to establish transactions, and then triggers thread release paths that call binder_send_failed_reply(). By racing this cleanup path against another thread that drops the final tmpref on the target binder_proc, the attacker forces the vulnerable code to dereference freed memory. Successful exploitation typically requires precise timing and heap-spray techniques to place attacker-controlled data at the freed slab location.

Refer to the upstream patches for the exact code paths: Kernel Git Commit #48aeda9f and Kernel Git Commit #f223d27a.

Detection Methods for CVE-2026-64468

Indicators of Compromise

KASAN reports containing slab-use-after-free in _raw_spin_lock with binder_free_transaction in the call trace
Kernel oops or panic logs referencing binder_send_failed_reply, binder_thread_release, or binder_ioctl immediately preceding the crash
Unexpected process crashes or reboots on systems with heavy Binder IPC usage from untrusted local applications

Detection Strategies

Enable KASAN on test and staging kernels to surface UAF conditions in the Binder driver before production deployment
Monitor dmesg and /var/log/kern.log for Binder-related stack traces and slab corruption warnings
Audit installed kernel versions against the fix commits listed in the NVD references to identify unpatched hosts

Monitoring Recommendations

Alert on kernel panics or oops events correlated with processes that open /dev/binder
Track process lineage for unprivileged binaries invoking Binder ioctls at abnormal rates, which may indicate race-condition exploitation attempts
Forward kernel telemetry to a centralized logging platform for retention and correlation across the fleet

How to Mitigate CVE-2026-64468

Immediate Actions Required

Update to a Linux kernel that includes the upstream fix commits referenced by the NVD entry
Prioritize patching on multi-tenant Linux hosts and Android-derived systems where untrusted code can reach /dev/binder
Restrict access to /dev/binder through discretionary access control and SELinux policy where the driver is not required

Patch Information

The fix pins the target thread t->to_thread before dropping t->lock, guaranteeing the target process remains alive across the inner lock acquisition. Patches have been merged into multiple stable branches. See the upstream commits: Kernel Git Commit #0be901ab, Kernel Git Commit #0f15f0f6, Kernel Git Commit #328ccf32, Kernel Git Commit #45df558c, Kernel Git Commit #48aeda9f, Kernel Git Commit #5602a43f, Kernel Git Commit #d45ef513, and Kernel Git Commit #f223d27a.

Workarounds

Disable or unload the Binder driver on Linux systems that do not require it, using modprobe -r binder_linux where applicable
Tighten file permissions on /dev/binder, /dev/hwbinder, and /dev/vndbinder to prevent unprivileged access
Apply seccomp filters or SELinux/AppArmor policies to block untrusted processes from issuing Binder ioctls

bash

# Restrict access to Binder device nodes as a temporary mitigation
chmod 0600 /dev/binder /dev/hwbinder /dev/vndbinder 2>/dev/null
chown root:root /dev/binder /dev/hwbinder /dev/vndbinder 2>/dev/null

# Verify the running kernel version against patched releases
uname -r

# Unload the Binder module where it is not required
lsmod | grep binder
modprobe -r binder_linux