SB2026081724 - Out-of-bounds write in Linux kernel android driver

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds write (CVE-ID: CVE-2026-68458)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt memory.

The vulnerability exists due to an out-of-bounds write in binder_transaction() in the Android Binder driver when processing binder transactions to a txn_security_ctx node. A local user can send a crafted binder transaction with BINDER_TYPE_PTR objects to corrupt memory.

The issue occurs because the security context length is read after it has been cleared, which causes the scatter-gather buffer end offset to be miscalculated.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/1228926e1e4d605cc74d9e675558982a6f2cf446
• https://git.kernel.org/stable/c/4257f45ee1fddd0558e77b62af8bb63fd87b2162
• https://git.kernel.org/stable/c/b34826e55aad3520ec813f1f367c11b24b29dc9f