Answer in brief
CVE-2026-98778 records a Unknown severity vulnerability in binder: fix is_failure flag for superseded transaction cleanup. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=9864bb4801331daa48514face9d0f4861e4d485b <60a9f7323ae7318a7cce0d387c318da24f1e8726 || >=9864bb4801331daa48514face9d0f4861e4d485b <86cdcc87d4ba60aebf94ba3346b3c900c5cd79ff || >=9864bb4801331daa48514face9d0f4861e4d485b <1ab671b50714ad8e359cf37eb041d8044319ccdc || >=9864bb4801331daa48514face9d0f4861e4d485b <22c135635fdd9816c0ef140d6de7b2e4fdf73e89 | 60a9f7323ae7318a7cce0d387c318da24f1e8726, 86cdcc87d4ba60aebf94ba3346b3c900c5cd79ff, 1ab671b50714ad8e359cf37eb041d8044319ccdc, 22c135635fdd9816c0ef140d6de7b2e4fdf73e89 |
| Linux/Linuxgeneric | 6.0 | Not reported |
| Linux/Linuxgeneric | >=9864bb4801331daa48514face9d0f4861e4d485b <e9b364e46d594c2ec663c9c49f10c1ca541ecc0f || >=9864bb4801331daa48514face9d0f4861e4d485b <60a9f7323ae7318a7cce0d387c318da24f1e8726 || >=9864bb4801331daa48514face9d0f4861e4d485b <86cdcc87d4ba60aebf94ba3346b3c900c5cd79ff || >=9864bb4801331daa48514face9d0f4861e4d485b <1ab671b50714ad8e359cf37eb041d8044319ccdc || >=9864bb4801331daa48514face9d0f4861e4d485b <22c135635fdd9816c0ef140d6de7b2e4fdf73e89 | e9b364e46d594c2ec663c9c49f10c1ca541ecc0f, 60a9f7323ae7318a7cce0d387c318da24f1e8726, 86cdcc87d4ba60aebf94ba3346b3c900c5cd79ff, 1ab671b50714ad8e359cf37eb041d8044319ccdc, 22c135635fdd9816c0ef140d6de7b2e4fdf73e89 |
Published upstream
Oct 18, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 21, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 18, 2026
In the Linux kernel, the following vulnerability has been resolved: binder: fix is_failure flag for superseded transaction cleanup When a TF_UPDATE_TXN transaction supersedes a pending async transaction, binder_release_entire_buffer() is called with is_failure=false. Since the superseded transaction was never delivered, binder_apply_fd_fixups() was never called and no fds were installed in the target process. With is_failure=false, the BINDER_TYPE_FDA cleanup handler interprets stale buffer contents as installed fd numbers and passes them to binder_deferred_fd_close(), closing unrelated file descriptors. Pass is_failure=true since the transaction was never delivered to the target, matching the semantics of all other undelivered-transaction cleanup paths.
Quoted source text, attributed separately from HOL analysis.