{"affected":[{"conditional":false,"product":"linux_kernel","source":"NVD","vendor":"linux","versions":[{"greaterThanOrEqual":"4.14","lessThan":"5.10.261","status":"affected","version":"*","versionType":"custom"}]},{"conditional":false,"product":"linux_kernel","source":"NVD","vendor":"linux","versions":[{"greaterThanOrEqual":"5.11","lessThan":"5.15.212","status":"affected","version":"*","versionType":"custom"}]},{"conditional":false,"product":"linux_kernel","source":"NVD","vendor":"linux","versions":[{"greaterThanOrEqual":"5.16","lessThan":"6.1.178","status":"affected","version":"*","versionType":"custom"}]},{"conditional":false,"product":"linux_kernel","source":"NVD","vendor":"linux","versions":[{"greaterThanOrEqual":"6.2","lessThan":"6.6.145","status":"affected","version":"*","versionType":"custom"}]},{"conditional":false,"product":"linux_kernel","source":"NVD","vendor":"linux","versions":[{"greaterThanOrEqual":"6.7","lessThan":"6.12.96","status":"affected","version":"*","versionType":"custom"}]},{"conditional":false,"product":"linux_kernel","source":"NVD","vendor":"linux","versions":[{"greaterThanOrEqual":"6.13","lessThan":"6.18.39","status":"affected","version":"*","versionType":"custom"}]},{"conditional":false,"product":"linux_kernel","source":"NVD","vendor":"linux","versions":[{"greaterThanOrEqual":"6.19","lessThan":"7.1.4","status":"affected","version":"*","versionType":"custom"}]},{"conditional":false,"product":"linux_kernel","source":"NVD","vendor":"linux","versions":[{"status":"affected","version":"7.2","versionType":"custom"}]}],"cpeConfigurations":[{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.261","versionStartIncluding":"4.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.212","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.178","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.145","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.96","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.39","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.4","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:*","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"cveId":"CVE-2026-64469","cwes":["CWE-416"],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbinder: fix UAF in binder_thread_release()\n\nWhen a thread exits, binder_thread_release() walks its transaction stack\nto clear the t->from and t->to_proc that correspond with the exiting\nthread. However, a process dying in parallel might attempt to kfree some\nof these transactions. And if one of them has no associated t->to_proc,\nthe t->to_proc->inner_lock will not be acquired.\n\nThis means that transaction accesses in binder_thread_release() after\nt->to_proc has been cleared might race with binder_free_transaction()\nand cause a use-after-free error as reported by KASAN:\n\n  ==================================================================\n  BUG: KASAN: slab-use-after-free in binder_thread_release+0x5d0/0x798\n  Write of size 8 at addr ffff000016627500 by task X/715\n\n  CPU: 17 UID: 0 PID: 715 Comm: X Not tainted 7.1.0-rc5-00149-g8fde5d1d47f6 #30 PREEMPT\n  Hardware name: linux,dummy-virt (DT)\n  Call trace:\n   binder_thread_release+0x5d0/0x798\n   binder_ioctl+0x12c0/0x299c\n   [...]\n\n  Allocated by task 717 on cpu 18 at 67.267803s:\n   __kasan_kmalloc+0xa0/0xbc\n   __kmalloc_cache_noprof+0x174/0x444\n   binder_transaction+0x554/0x8150\n   binder_thread_write+0xa30/0x4354\n   binder_ioctl+0x20f0/0x299c\n   [...]\n\n  Freed by task 202 on cpu 18 at 90.416221s:\n   __kasan_slab_free+0x58/0x80\n   kfree+0x1a0/0x4a4\n   binder_free_transaction+0x150/0x294\n   binder_send_failed_reply+0x398/0x6d8\n   binder_release_work+0x3e4/0x4ec\n   binder_deferred_func+0xbd8/0x104c\n   [...]\n  ==================================================================\n\nIn order to avoid this, make sure that binder_free_transaction() reads\nthe t->to_proc under the transaction lock. This will serialize the\ntransaction release with the accesses in binder_thread_release(). Plus,\nit matches the documented locking rules for @to_proc.","epss":{"date":"2026-11-10","percentile":0.03021,"score":0.00135},"exploits":[],"kev":null,"metrics":[{"score":7.8,"severity":"high","source":"NVD: 416baaa9-dc9f-4396-8d5f-8c081fb06d67","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1794506575273,"publishedAt":1784974652247,"references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/114a116aaa5f0295376cdf12da743c5bce3b20ce"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1f96f8c0a6ed4f6d01d3dd29ad0cbf08dde96082"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/38e1a71728e5795b670cc159c18e286a40aeebb4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/df1a17abba8d6fac5f965adcb8113ceace6e4949"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e63032dc715026a96bcaa13d375a8e15c91caa84"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ea02df466df60ecd758eb3b4df3f0cadc5c886ce"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ef5439ba5b9ac93349f5df12ef88b42a0ce26340"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/faa070c7ad8ba25dcd0b12d7cdbb419e336f5391"}],"remediation":[{"kind":"fix","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://git.kernel.org/stable/c/114a116aaa5f0295376cdf12da743c5bce3b20ce"},{"kind":"fix","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://git.kernel.org/stable/c/1f96f8c0a6ed4f6d01d3dd29ad0cbf08dde96082"},{"kind":"fix","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://git.kernel.org/stable/c/38e1a71728e5795b670cc159c18e286a40aeebb4"},{"kind":"fix","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://git.kernel.org/stable/c/df1a17abba8d6fac5f965adcb8113ceace6e4949"},{"kind":"fix","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://git.kernel.org/stable/c/e63032dc715026a96bcaa13d375a8e15c91caa84"},{"kind":"fix","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://git.kernel.org/stable/c/ea02df466df60ecd758eb3b4df3f0cadc5c886ce"},{"kind":"fix","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://git.kernel.org/stable/c/ef5439ba5b9ac93349f5df12ef88b42a0ce26340"},{"kind":"fix","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://git.kernel.org/stable/c/faa070c7ad8ba25dcd0b12d7cdbb419e336f5391"}],"revision":"410edcd6f11de319f3b670ef217a9d14075a0ef9b40bc44e207e6c1a652e6d35","sources":[{"modifiedAt":1794506575273,"name":"NVD","retrievedAt":1794507349009,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64469"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794462705514,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-64469"}],"ssvc":null,"status":"published","title":"CVE-2026-64469","updatedAt":1794507349009}