# CVE-2026-64469: linux: In the Linux kernel, the following vulnerability has been resolved:  binder: fix UAF in binder_thread_release()  When...

CVE-2026-64469 is fixed in 2 products on 1 platform, first by DEBIAN-CVE-2026-64469, released July 26, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-64469
- Priority: High
- CVSS: 7.8 (high)
- EPSS: 0.0014
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jul 25, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:  binder: fix UAF in binder_thread_release()  When a thread exits, binder_thread_release() walks its transaction stack to clear the t->from and t->to_proc that correspond with the exiting thread. However, a process dying in parallel might attempt to kfree some of these transactions. And if one of them has no associated t->to_proc, the t->to_proc->inner_lock will not be acquired.  This means that transaction accesses in binder_thread_release() after t->to_proc has been cleared might race with binder_free_transaction() and cause a use-after-free error as reported by KASAN:    ==================================================================   BUG: KASAN: slab-use-after-free in binder_thread_release+0x5d0/0x798   Write of size 8 at addr ffff000016627500 by task X/715    CPU: 17 UID: 0 PID: 715 Comm: X Not tainted 7.1.0-rc5-00149-g8fde5d1d47f6 #30 PREEMPT   Hardware name: linux,dummy-virt (DT)   Call trace:    binder_thread_release+0x5d0/0x798    binder_ioctl+0x12c0/0x299c    [...]    Allocated by task 717 on cpu 18 at 67.267803s:    __kasan_kmalloc+0xa0/0xbc    __kmalloc_cache_noprof+0x174/0x444    binder_transaction+0x554/0x8150    binder_thread_write+0xa30/0x4354    binder_ioctl+0x20f0/0x299c    [...]    Freed by task 202 on cpu 18 at 90.416221s:    __kasan_slab_free+0x58/0x80    kfree+0x1a0/0x4a4    binder_free_transaction+0x150/0x294    binder_send_failed_reply+0x398/0x6d8    binder_release_work+0x3e4/0x4ec    binder_deferred_func+0xbd8/0x104c    [...]   ==================================================================  In order to avoid this, make sure that binder_free_transaction() reads the t->to_proc under the transaction lock. This will serialize the transaction release with the accesses in binder_thread_release(). Plus, it matches the documented locking rules for @to_proc.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 12.15 (bookworm) | 6.1.180-1 | [DEBIAN-CVE-2026-64469](https://patchblox.com/security/data/fix/linux/debian-cve-2026-64469.md) | Jul 26, 2026 |
| Linux | linux Debian 13.5 (trixie) | 6.12.96-1 | [DEBIAN-CVE-2026-64469](https://patchblox.com/security/data/fix/linux/debian-cve-2026-64469.md) | Jul 26, 2026 |
| Linux | linux Debian 14 | 7.1.4-1 | [DEBIAN-CVE-2026-64469](https://patchblox.com/security/data/fix/linux/debian-cve-2026-64469.md) | Jul 26, 2026 |
| Linux | linux-6.12 Debian 12.15 (bookworm) | 6.12.100-1~deb12u1 | [DEBIAN-CVE-2026-64469](https://patchblox.com/security/data/fix/linux/debian-cve-2026-64469.md) | Jul 26, 2026 |

---

Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.