{
  "cveId": "CVE-2026-64469",
  "url": "https://patchblox.com/security/cve/CVE-2026-64469",
  "summary": "CVE-2026-64469 is fixed in 2 products on 1 platform, first by DEBIAN-CVE-2026-64469, released July 26, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  binder: fix UAF in binder_thread_release()  When...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  binder: fix UAF in binder_thread_release()  When a thread exits, binder_thread_release() walks its transaction stack to clear the t-\u003Efrom and t-\u003Eto_proc that correspond with the exiting thread. However, a process dying in parallel might attempt to kfree some of these transactions. And if one of them has no associated t-\u003Eto_proc, the t-\u003Eto_proc-\u003Einner_lock will not be acquired.  This means that transaction accesses in binder_thread_release() after t-\u003Eto_proc has been cleared might race with binder_free_transaction() and cause a use-after-free error as reported by KASAN:    ==================================================================   BUG: KASAN: slab-use-after-free in binder_thread_release\u002B0x5d0/0x798   Write of size 8 at addr ffff000016627500 by task X/715    CPU: 17 UID: 0 PID: 715 Comm: X Not tainted 7.1.0-rc5-00149-g8fde5d1d47f6 #30 PREEMPT   Hardware name: linux,dummy-virt (DT)   Call trace:    binder_thread_release\u002B0x5d0/0x798    binder_ioctl\u002B0x12c0/0x299c    [...]    Allocated by task 717 on cpu 18 at 67.267803s:    __kasan_kmalloc\u002B0xa0/0xbc    __kmalloc_cache_noprof\u002B0x174/0x444    binder_transaction\u002B0x554/0x8150    binder_thread_write\u002B0xa30/0x4354    binder_ioctl\u002B0x20f0/0x299c    [...]    Freed by task 202 on cpu 18 at 90.416221s:    __kasan_slab_free\u002B0x58/0x80    kfree\u002B0x1a0/0x4a4    binder_free_transaction\u002B0x150/0x294    binder_send_failed_reply\u002B0x398/0x6d8    binder_release_work\u002B0x3e4/0x4ec    binder_deferred_func\u002B0xbd8/0x104c    [...]   ==================================================================  In order to avoid this, make sure that binder_free_transaction() reads the t-\u003Eto_proc under the transaction lock. This will serialize the transaction release with the accesses in binder_thread_release(). Plus, it matches the documented locking rules for @to_proc.",
  "published": "2026-07-25T10:17:32Z",
  "severity": "high",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00135,
  "epssPercentile": 0.03012,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.1.180-1",
      "fix": "DEBIAN-CVE-2026-64469",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-64469",
      "released": "2026-07-26T13:52:50Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.12.96-1",
      "fix": "DEBIAN-CVE-2026-64469",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-64469",
      "released": "2026-07-26T13:52:50Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.1.4-1",
      "fix": "DEBIAN-CVE-2026-64469",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-64469",
      "released": "2026-07-26T13:52:50Z"
    },
    {
      "platform": "linux",
      "product": "linux-6.12",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.12.100-1~deb12u1",
      "fix": "DEBIAN-CVE-2026-64469",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-64469",
      "released": "2026-07-26T13:52:50Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}