{"affected":[{"conditional":false,"product":"linux_kernel","source":"NVD","vendor":"linux","versions":[{"greaterThanOrEqual":"4.14.136","lessThan":"4.15","status":"affected","version":"*","versionType":"custom"}]},{"conditional":false,"product":"linux_kernel","source":"NVD","vendor":"linux","versions":[{"greaterThanOrEqual":"4.19.64","lessThan":"4.20","status":"affected","version":"*","versionType":"custom"}]},{"conditional":false,"product":"linux_kernel","source":"NVD","vendor":"linux","versions":[{"greaterThanOrEqual":"5.1.15","lessThan":"5.2","status":"affected","version":"*","versionType":"custom"}]},{"conditional":false,"product":"linux_kernel","source":"NVD","vendor":"linux","versions":[{"greaterThanOrEqual":"5.2.1","lessThan":"5.10.261","status":"affected","version":"*","versionType":"custom"}]},{"conditional":false,"product":"linux_kernel","source":"NVD","vendor":"linux","versions":[{"greaterThanOrEqual":"5.11","lessThan":"5.15.212","status":"affected","version":"*","versionType":"custom"}]},{"conditional":false,"product":"linux_kernel","source":"NVD","vendor":"linux","versions":[{"greaterThanOrEqual":"5.16","lessThan":"6.1.178","status":"affected","version":"*","versionType":"custom"}]},{"conditional":false,"product":"linux_kernel","source":"NVD","vendor":"linux","versions":[{"greaterThanOrEqual":"6.2","lessThan":"6.6.145","status":"affected","version":"*","versionType":"custom"}]},{"conditional":false,"product":"linux_kernel","source":"NVD","vendor":"linux","versions":[{"greaterThanOrEqual":"6.7","lessThan":"6.12.96","status":"affected","version":"*","versionType":"custom"}]},{"conditional":false,"product":"linux_kernel","source":"NVD","vendor":"linux","versions":[{"greaterThanOrEqual":"6.13","lessThan":"6.18.39","status":"affected","version":"*","versionType":"custom"}]},{"conditional":false,"product":"linux_kernel","source":"NVD","vendor":"linux","versions":[{"greaterThanOrEqual":"6.19","lessThan":"7.1.4","status":"affected","version":"*","versionType":"custom"}]},{"conditional":false,"product":"linux_kernel","source":"NVD","vendor":"linux","versions":[{"status":"affected","version":"5.2","versionType":"custom"}]},{"conditional":false,"product":"linux_kernel","source":"NVD","vendor":"linux","versions":[{"status":"affected","version":"7.2","versionType":"custom"}]}],"cpeConfigurations":[{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"4.15","versionStartIncluding":"4.14.136","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"4.20","versionStartIncluding":"4.19.64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.2","versionStartIncluding":"5.1.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.261","versionStartIncluding":"5.2.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.212","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.178","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.145","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.96","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.39","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.4","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.2:-:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.2:rc6:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.2:rc7:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:*","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"cveId":"CVE-2026-64468","cwes":["CWE-416"],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbinder: fix UAF in binder_free_transaction()\n\nIn binder_free_transaction(), the t->to_proc is read under the t->lock.\nHowever, once the t->lock is dropped, the to_proc can die in parallel.\nThis leads to a use-after-free error when we attempt to acquire its\ninner lock right afterwards:\n\n  ==================================================================\n  BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x1a0\n  Write of size 4 at addr ffff00001125da70 by task B/672\n\n  CPU: 20 UID: 0 PID: 672 Comm: B Not tainted 7.1.0-rc6-00284-g8e65320d91cd #4 PREEMPT\n  Hardware name: linux,dummy-virt (DT)\n  Call trace:\n   _raw_spin_lock+0xe4/0x1a0\n   binder_free_transaction+0x8c/0x320\n   binder_send_failed_reply+0x21c/0x2f8\n   binder_thread_release+0x488/0x7e0\n   binder_ioctl+0x12c0/0x29a0\n  [...]\n\n  Allocated by task 675:\n   __kmalloc_cache_noprof+0x174/0x444\n   binder_open+0x118/0xb70\n   do_dentry_open+0x374/0x1040\n   vfs_open+0x58/0x3bc\n  [...]\n\n  Freed by task 212:\n   __kasan_slab_free+0x58/0x80\n   kfree+0x1a0/0x4a4\n   binder_proc_dec_tmpref+0x32c/0x5e0\n   binder_deferred_func+0xc48/0x104c\n   process_one_work+0x53c/0xbc0\n  [...]\n  ==================================================================\n\nTo prevent this, pin the target thread (t->to_thread) to guarantee the\ntarget process remains alive. Undelivered transactions without a target\nthread are already safe, as the target process can only be the current\ncontext in those paths.","epss":{"date":"2026-11-10","percentile":0.02991,"score":0.00135},"exploits":[],"kev":null,"metrics":[{"score":7.8,"severity":"high","source":"NVD: 416baaa9-dc9f-4396-8d5f-8c081fb06d67","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1794506552117,"publishedAt":1784974652103,"references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0be901ab1dcc4af59b88f2e324493bb283850167"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0f15f0f6ca5df566275ce517f257af2559528b41"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/328ccf32acb87e8bbb1fe2b065068c574e4db2bf"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/45df558c543bb5543bacc8065fd7c567740781e5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/48aeda9f8039e4a6971d1804578efde7f2c01eda"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5602a43f251c3d75312df91a422675fc00ca3dce"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d45ef513eed1abebfec90c3cfb6ae50c2a4182db"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f223d27a546c1e1f48d38fd67760e78f068fe8c4"}],"remediation":[{"kind":"fix","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://git.kernel.org/stable/c/0be901ab1dcc4af59b88f2e324493bb283850167"},{"kind":"fix","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://git.kernel.org/stable/c/0f15f0f6ca5df566275ce517f257af2559528b41"},{"kind":"fix","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://git.kernel.org/stable/c/328ccf32acb87e8bbb1fe2b065068c574e4db2bf"},{"kind":"fix","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://git.kernel.org/stable/c/45df558c543bb5543bacc8065fd7c567740781e5"},{"kind":"fix","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://git.kernel.org/stable/c/48aeda9f8039e4a6971d1804578efde7f2c01eda"},{"kind":"fix","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://git.kernel.org/stable/c/5602a43f251c3d75312df91a422675fc00ca3dce"},{"kind":"fix","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://git.kernel.org/stable/c/d45ef513eed1abebfec90c3cfb6ae50c2a4182db"},{"kind":"fix","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://git.kernel.org/stable/c/f223d27a546c1e1f48d38fd67760e78f068fe8c4"}],"revision":"a3073e16918f969e95fa8462bdc39788c467f950e30237f5422ebfff844de18d","sources":[{"modifiedAt":1794506552117,"name":"NVD","retrievedAt":1794507348799,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64468"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794462705617,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-64468"}],"ssvc":null,"status":"published","title":"CVE-2026-64468","updatedAt":1794507348799}