In the Linux kernel, the following vulnerability has been resolved:

binder: fix is failure flag for superseded transaction cleanup

When a TF UPDATE TXN transaction supersedes a pending async transaction, binder release entire buffer() is called with is failure=false. Since the superseded transaction was never delivered, binder apply fd fixups() was never called and no fds were installed in the target process.

With is failure=false, the BINDER TYPE FDA cleanup handler interprets stale buffer contents as installed fd numbers and passes them to binder deferred fd close(), closing unrelated file descriptors.

Pass is failure=true since the transaction was never delivered to the target, matching the semantics of all other undelivered-transaction cleanup paths.