CVE-2026-98777

In the Linux kernel, the following vulnerability has been resolved:

binder: fix leaked fd fixups on TF UPDATE TXN supersede

When a TF UPDATE TXN transaction supersedes a pending async transaction in a frozen process, the outdated transaction is freed with kfree() directly. This skips binder free txn fixups(), leaking all binder txn fd fixup entries and their fget()'d struct file references.

The leaked file refcounts never reach zero, so the struct file objects are permanently pinned in memory. They survive process exit and accumulate across invocations until file-max exhaustion.

Every other transaction cleanup path (binder free transaction(), binder transaction() error paths, binder release work()) correctly calls binder free txn fixups(). Add the missing call before kfree() in the t outdated cleanup block.