CVE-2026-64468

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.1.0-rc6

Description A use-after-free error exists in the binder free transaction() function. The issue occurs because t->to proc is read while holding t->lock, but the target process can terminate in parallel after t->lock is released. This results in a use-after-free when the system subsequently attempts to acquire the inner lock of the deceased process. The flaw is triggered during the execution of the binder free transaction() function, which is called by binder send failed reply(), binder thread release(), and binder ioctl().

Recommendations Update the Linux kernel to version 7.1.0-rc6 or later.