CVE-2026-68458: binder: cache secctx size before release zeroes it

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

binder: cache secctx size before release zeroes it

binder_transaction() bounds the scatter-gather buffer area with
sg_buf_end_offset and subtracts the aligned LSM context size because
the secctx is written at the tail of that area.  The subtraction reads
lsmctx.len, but that field has already been cleared by the time the
line runs:

    security_secid_to_secctx(secid, &lsmctx)   /* lsmctx.len set */
    lsmctx_aligned_size = ALIGN(lsmctx.len, sizeof(u64))
    extra_buffers_size += lsmctx_aligned_size
    ...
    security_release_secctx(&lsmctx)            /* memset zeroes len */
    ...
    sg_buf_end_offset = sg_buf_offset + extra_buffers_size
                        - ALIGN(lsmctx.len, sizeof(u64)) /* ALIGN(0,8) */

security_release_secctx() does memset(cp, 0, sizeof(*cp)), so lsmctx.len
reads back as 0 and the subtraction contributes nothing, leaving
sg_buf_end_offset too large by the aligned secctx size on every
transaction to a txn_security_ctx node.

Each BINDER_TYPE_PTR object then derives buf_left = sg_buf_end_offset -
sg_buf_offset as the sole upper bound on its copy, so the inflated end
offset lets the copy run into the bytes that already hold the secctx.

The aligned size must therefore be cached before release rather than
re-read from the now-cleared field.  Fix by caching it in
lsmctx_aligned_size at function scope when it is first computed and
subtracting lsmctx_aligned_size instead of re-reading lsmctx.len after
release.  Reuse the same value for the earlier buf_offset computation.

The Linux kernel CVE team has assigned CVE-2026-68458 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.14 with commit 6fba89813ccf333d2bc4d5caea04cd5f3c39eb50 and fixed in 6.18.40 with commit 1228926e1e4d605cc74d9e675558982a6f2cf446
	Issue introduced in 6.14 with commit 6fba89813ccf333d2bc4d5caea04cd5f3c39eb50 and fixed in 7.1.5 with commit 4257f45ee1fddd0558e77b62af8bb63fd87b2162
	Issue introduced in 6.14 with commit 6fba89813ccf333d2bc4d5caea04cd5f3c39eb50 and fixed in 7.2-rc3 with commit b34826e55aad3520ec813f1f367c11b24b29dc9f

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-68458
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/android/binder.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/1228926e1e4d605cc74d9e675558982a6f2cf446
	https://git.kernel.org/stable/c/4257f45ee1fddd0558e77b62af8bb63fd87b2162
	https://git.kernel.org/stable/c/b34826e55aad3520ec813f1f367c11b24b29dc9f