SB2026102386 - Improper update of reference count in Linux kernel binder node driver

Description

This security bulletin contains information about 1 vulnerability.

1) Improper update of reference count (CVE-ID: CVE-2026-99075)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause kernel memory to remain allocated unnecessarily, potentially leading to a denial of service through resource exhaustion.

The vulnerability exists due to improper reference count update handling in the Rust Binder Node::cancel() and NodeWrapper::cancel() methods when a thread exits through BINDER_THREAD_EXIT with a pending node reference count increment. A local user can trigger thread exit while such an update is pending to cause the update to be discarded, leaving node delivery and count states desynchronized and preventing affected nodes from being freed after all external references are dropped.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/2a74ccd1bcc170e66525f34e9de8652b57e2cf3d
• https://git.kernel.org/stable/c/71cbad138969edecef01b28dff87d91b56db538d
• https://git.kernel.org/stable/c/fb0f8dfc5a030ed3d60a1d03acdc99c90ee99fc1