CVE-2026-68458

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the binder component where the binder transaction() function incorrectly calculates the scatter-gather buffer area boundary. The function uses sg buf end offset to bound the area and subtracts the aligned Linux Security Module (LSM) context size. However, the security release secctx() function clears the lsmctx.len field via a memset operation before the subtraction occurs. Consequently, the subtraction results in zero, making sg buf end offset too large. This allows BINDER TYPE PTR objects to exceed their intended copy bounds and overwrite bytes containing the security context.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.