CVE-2026-98777: Linux Kernel Binder DOS Vulnerability

CVE-2026-98777 Overview

CVE-2026-98777 is a memory leak vulnerability in the Linux kernel binder driver. The flaw occurs when a TF_UPDATE_TXN transaction supersedes a pending async transaction in a frozen process. The outdated transaction is freed with kfree() directly, bypassing binder_free_txn_fixups(). This leaks every binder_txn_fd_fixup entry and the associated fget() struct file reference. The leaked file reference counts never reach zero, pinning struct file objects in kernel memory permanently. The leaked references accumulate across process exits until file-max exhaustion causes system-wide denial of service.

Critical Impact
Repeated triggering of superseded async transactions in frozen binder processes exhausts the kernel file descriptor table, leading to denial of service across all processes on the system.

Affected Products

Linux kernel versions containing the binder TF_UPDATE_TXN supersede code path
Android devices using affected Linux kernel binder IPC
Downstream distributions shipping unpatched stable kernel branches

Discovery Timeline

2026-10-18 - CVE-2026-98777 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98777

Vulnerability Analysis

The Linux binder driver supports asynchronous transactions between processes. When a sender issues a transaction with the TF_UPDATE_TXN flag targeting a frozen receiver, the newer transaction supersedes any pending async transaction already queued for that target. The supersede cleanup path releases the outdated transaction object using kfree() without invoking the standard fixup teardown routine. This classifies the issue as a kernel memory leak [CWE-401] with resource exhaustion impact.

Every valid transaction cleanup path, including binder_free_transaction(), the error paths inside binder_transaction(), and binder_release_work(), correctly calls binder_free_txn_fixups(). The t_outdated block is the sole exception. The fix adds the missing binder_free_txn_fixups() invocation before kfree() in that cleanup block.

Root Cause

The root cause is an incomplete cleanup routine in the binder transaction supersede logic. Any file descriptor queued as a binder_txn_fd_fixup on the outdated transaction holds a kernel file reference obtained through fget(). When the transaction structure is released with a bare kfree(), those fixup entries and their file references are abandoned. The reference count on each struct file never decrements, so the kernel treats the files as perpetually in use.

Attack Vector

A local, unprivileged process able to send binder transactions can trigger the leak. The attacker sends an async transaction containing file descriptors to a target process that is subsequently frozen, then sends a TF_UPDATE_TXN transaction to supersede the first. Each cycle leaks the file references attached to the superseded transaction. Repeated invocation accumulates leaked struct file objects until the kernel reaches the file-max limit, denying file operations system-wide. The vulnerability is reachable from any process with binder access, including sandboxed Android applications.

See the upstream fix in Kernel Git Commit a7329ea for the exact code change.

Detection Methods for CVE-2026-98777

Indicators of Compromise

Steady, unexplained growth in /proc/sys/fs/file-nr open file count without a corresponding increase in process file descriptor usage.
Kernel log entries referencing VFS: file-max limit reached, or EMFILE/ENFILE errors returned to userspace under normal workload.
Repeated binder transactions with the TF_UPDATE_TXN flag directed at frozen processes observed in binder tracing.

Detection Strategies

Monitor the global open file count via /proc/sys/fs/file-nr and alert on sustained upward drift that does not track workload.
Enable binder tracepoints (binder_transaction, binder_transaction_received) and correlate TF_UPDATE_TXN flagged transactions with frozen target processes.
Compare running kernel version and binder source against the fix commits to identify unpatched hosts.

Monitoring Recommendations

Track Android cgroup freezer events alongside binder IPC telemetry to detect the frozen-target precondition.
Alert on processes repeatedly sending async binder transactions carrying file descriptors to the same target within short windows.
Collect kernel memory and slab statistics for binder_transaction and binder_txn_fd_fixup allocations to catch anomalous growth.

How to Mitigate CVE-2026-98777

Immediate Actions Required

Apply the upstream fix from Kernel Git Commit a7329ea or the backported commit matching your stable branch.
Rebuild and redeploy affected kernels, prioritizing Android device images and Linux hosts running binder-dependent workloads.
Audit file-max and open file counters on long-running systems; reboot hosts showing sustained leakage pending patch deployment.

Patch Information

The fix is distributed across multiple stable branches. Reference commits: 1299cb3, 6673f4f, 7fd609f, a7329ea, and c4c0208. Each commit adds the missing binder_free_txn_fixups() call before kfree() in the t_outdated cleanup block.

Workarounds

No fully effective workaround exists; the leak occurs inside the kernel binder driver and cannot be prevented from userspace.
Where binder IPC is not required, consider disabling the binder driver via kernel configuration (CONFIG_ANDROID_BINDER_IPC=n).
Raise fs.file-max as a temporary measure to delay exhaustion while patches are staged, understanding this only extends the time to failure.

bash

# Verify kernel version and raise file-max as a temporary mitigation
uname -r
sysctl -w fs.file-max=2097152
cat /proc/sys/fs/file-nr