ASB-A-468680876

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-468680876.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-468680876
Aliases
Published
2026-11-01T00:00:00Z
Modified
2026-11-02T16:56:25Z
Summary
[none]
Details

In binder_transaction of binder.c, there is a possible use-after-free due to a race condition. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android / :linux_kernel:

Package

Name
:linux_kernel:

Affected ranges

Type
ECOSYSTEM
Events
Introduced
:0
Fixed
:2026-11-05

Affected versions

Other
Kernel

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/kernel/common/+/1c8fffa12a81f62411312825521d63a81d1ca92e"
    ],
    "severity":  "High",
    "spl":  "2026-11-05",
    "types":  [
        "DoS"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "292721611640359062750241658260354774319",
                "length":  20596
            },
            "id":  "ASB-A-468680876-07b3fdcc",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/kernel/common/+/1c8fffa12a81f62411312825521d63a81d1ca92e",
            "target":  {
                "file":  "drivers/android/binder.c",
                "function":  "binder_transaction",
                "truncated_path_level":  1
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "102186528262440842446174308854054506424",
                    "215444748068280150020433832815844783837",
                    "106050918330106691462352632683372805711",
                    "186882895859409720762755226513863923791",
                    "73459573619979287906696054572438982782",
                    "297235728462984358161341747057319566352",
                    "47602951939085402005588031262182968075",
                    "236444568068537989923478614733525644605",
                    "240308107299844078423223490035898257366",
                    "44357881221828095460173770385715437388",
                    "272631207531283576997540003003697175815"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-468680876-5072e65f",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/kernel/common/+/1c8fffa12a81f62411312825521d63a81d1ca92e",
            "target":  {
                "file":  "drivers/android/binder.c",
                "truncated_path_level":  1
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-468680876.json"