CVE-2026-98778

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

binder: fix is_failure flag for superseded transaction cleanup

When a TF_UPDATE_TXN transaction supersedes a pending async transaction,

binder_release_entire_buffer() is called with is_failure=false. Since the

superseded transaction was never delivered, binder_apply_fd_fixups() was

never called and no fds were installed in the target process.

With is_failure=false, the BINDER_TYPE_FDA cleanup handler interprets

stale buffer contents as installed fd numbers and passes them to

binder_deferred_fd_close(), closing unrelated file descriptors.

Pass is_failure=true since the transaction was never delivered to the

target, matching the semantics of all other undelivered-transaction

cleanup paths.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References