{
  "cveId": "CVE-2026-23184",
  "url": "https://patchblox.com/security/cve/CVE-2026-23184",
  "summary": "CVE-2026-23184 is fixed in linux on 1 platform by DEBIAN-CVE-2026-23184 (version 6.18.10-1), released February 14, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  binder: fix UAF in binder_netlink_report()  Onew...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  binder: fix UAF in binder_netlink_report()  Oneway transactions sent to frozen targets via binder_proc_transaction() return a BR_TRANSACTION_PENDING_FROZEN error but they are still treated as successful since the target is expected to thaw at some point. It is then not safe to access \u0027t\u0027 after BR_TRANSACTION_PENDING_FROZEN errors as the transaction could have been consumed by the now thawed target.  This is the case for binder_netlink_report() which derreferences \u0027t\u0027 after a pending frozen error, as pointed out by the following KASAN report:    ==================================================================   BUG: KASAN: slab-use-after-free in binder_netlink_report.isra.0\u002B0x694/0x6c8   Read of size 8 at addr ffff00000f98ba38 by task binder-util/522    CPU: 4 UID: 0 PID: 522 Comm: binder-util Not tainted 6.19.0-rc6-00015-gc03e9c42ae8f #1 PREEMPT   Hardware name: linux,dummy-virt (DT)   Call trace:    binder_netlink_report.isra.0\u002B0x694/0x6c8    binder_transaction\u002B0x66e4/0x79b8    binder_thread_write\u002B0xab4/0x4440    binder_ioctl\u002B0x1fd4/0x2940    [...]    Allocated by task 522:    __kmalloc_cache_noprof\u002B0x17c/0x50c    binder_transaction\u002B0x584/0x79b8    binder_thread_write\u002B0xab4/0x4440    binder_ioctl\u002B0x1fd4/0x2940    [...]    Freed by task 488:    kfree\u002B0x1d0/0x420    binder_free_transaction\u002B0x150/0x234    binder_thread_read\u002B0x2d08/0x3ce4    binder_ioctl\u002B0x488/0x2940    [...]   ==================================================================  Instead, make a transaction copy so the data can be safely accessed by binder_netlink_report() after a pending frozen error. While here, add a comment about not using t-\u003Ebuffer in binder_netlink_report().",
  "published": "2026-02-14T17:15:56Z",
  "severity": "high",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00141,
  "epssPercentile": 0.0346,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.18.10-1",
      "fix": "DEBIAN-CVE-2026-23184",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-23184",
      "released": "2026-02-14T17:15:56Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T07:25:28Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}