CVE-2026-64468: binder: fix UAF in binder_free_transaction()

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

binder: fix UAF in binder_free_transaction()

In binder_free_transaction(), the t->to_proc is read under the t->lock.
However, once the t->lock is dropped, the to_proc can die in parallel.
This leads to a use-after-free error when we attempt to acquire its
inner lock right afterwards:

  ==================================================================
  BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x1a0
  Write of size 4 at addr ffff00001125da70 by task B/672

  CPU: 20 UID: 0 PID: 672 Comm: B Not tainted 7.1.0-rc6-00284-g8e65320d91cd #4 PREEMPT
  Hardware name: linux,dummy-virt (DT)
  Call trace:
   _raw_spin_lock+0xe4/0x1a0
   binder_free_transaction+0x8c/0x320
   binder_send_failed_reply+0x21c/0x2f8
   binder_thread_release+0x488/0x7e0
   binder_ioctl+0x12c0/0x29a0
  [...]

  Allocated by task 675:
   __kmalloc_cache_noprof+0x174/0x444
   binder_open+0x118/0xb70
   do_dentry_open+0x374/0x1040
   vfs_open+0x58/0x3bc
  [...]

  Freed by task 212:
   __kasan_slab_free+0x58/0x80
   kfree+0x1a0/0x4a4
   binder_proc_dec_tmpref+0x32c/0x5e0
   binder_deferred_func+0xc48/0x104c
   process_one_work+0x53c/0xbc0
  [...]
  ==================================================================

To prevent this, pin the target thread (t->to_thread) to guarantee the
target process remains alive. Undelivered transactions without a target
thread are already safe, as the target process can only be the current
context in those paths.

The Linux kernel CVE team has assigned CVE-2026-64468 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.2 with commit a370003cc301d4361bae20c9ef615f89bf8d1e8a and fixed in 5.10.261 with commit 5602a43f251c3d75312df91a422675fc00ca3dce
	Issue introduced in 5.2 with commit a370003cc301d4361bae20c9ef615f89bf8d1e8a and fixed in 5.15.212 with commit 0be901ab1dcc4af59b88f2e324493bb283850167
	Issue introduced in 5.2 with commit a370003cc301d4361bae20c9ef615f89bf8d1e8a and fixed in 6.1.178 with commit 48aeda9f8039e4a6971d1804578efde7f2c01eda
	Issue introduced in 5.2 with commit a370003cc301d4361bae20c9ef615f89bf8d1e8a and fixed in 6.6.145 with commit 45df558c543bb5543bacc8065fd7c567740781e5
	Issue introduced in 5.2 with commit a370003cc301d4361bae20c9ef615f89bf8d1e8a and fixed in 6.12.96 with commit d45ef513eed1abebfec90c3cfb6ae50c2a4182db
	Issue introduced in 5.2 with commit a370003cc301d4361bae20c9ef615f89bf8d1e8a and fixed in 6.18.39 with commit 328ccf32acb87e8bbb1fe2b065068c574e4db2bf
	Issue introduced in 5.2 with commit a370003cc301d4361bae20c9ef615f89bf8d1e8a and fixed in 7.1.4 with commit 0f15f0f6ca5df566275ce517f257af2559528b41
	Issue introduced in 5.2 with commit a370003cc301d4361bae20c9ef615f89bf8d1e8a and fixed in 7.2-rc3 with commit f223d27a546c1e1f48d38fd67760e78f068fe8c4
	Issue introduced in 4.14.136 with commit a4a3c070b8760f71c8311399fa9bfe67c8629bca
	Issue introduced in 4.19.64 with commit 22068d49d09d2b3890e19d7b2048a33340f992da
	Issue introduced in 5.1.15 with commit 0e3b977a8f1be01dcfa0baae68851b1f55f2a0a9

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64468
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/android/binder.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/5602a43f251c3d75312df91a422675fc00ca3dce
	https://git.kernel.org/stable/c/0be901ab1dcc4af59b88f2e324493bb283850167
	https://git.kernel.org/stable/c/48aeda9f8039e4a6971d1804578efde7f2c01eda
	https://git.kernel.org/stable/c/45df558c543bb5543bacc8065fd7c567740781e5
	https://git.kernel.org/stable/c/d45ef513eed1abebfec90c3cfb6ae50c2a4182db
	https://git.kernel.org/stable/c/328ccf32acb87e8bbb1fe2b065068c574e4db2bf
	https://git.kernel.org/stable/c/0f15f0f6ca5df566275ce517f257af2559528b41
	https://git.kernel.org/stable/c/f223d27a546c1e1f48d38fd67760e78f068fe8c4