VulnSocial

CVE-2026-64468PoC

MEDIUMCVSS 7.8 · HIGH

Exploit discussion active in current signal (3 latest mentions)

Immediate actions

  • Patch affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF in binder_free_transaction() In binder_free_transaction(), the t->to_proc is read under the t->lock. However, once the t->lock is dropped, the to_proc can die in parallel. This leads to a use-after-free error when we attempt to acquire its inner lock right afterwards: ================================================================== BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x1a0 Write of size 4 at addr ffff00001125da70 by task B/672 CPU: 20 UID: 0 PID: 672 Comm: B Not tainted 7.1.0-rc6-00284-g8e65320d91cd #4 PREEMPT Hardware name: linux,dummy-virt (DT) Call trace: _raw_spin_lock+0xe4/0x1a0 binder_free_transaction+0x8c/0x320 binder_send_failed_reply+0x21c/0x2f8 binder_thread_release+0x488/0x7e0 binder_ioctl+0x12c0/0x29a0 [...] Allocated by task 675: __kmalloc_cache_noprof+0x174/0x444 binder_open+0x118/0xb70 do_dentry_open+0x374/0x1040 vfs_open+0x58/0x3bc [...] Freed by task 212: __kasan_slab_free+0x58/0x80 kfree+0x1a0/0x4a4 binder_proc_dec_tmpref+0x32c/0x5e0 binder_deferred_func+0xc48/0x104c process_one_work+0x53c/0xbc0 [...] ================================================================== To prevent this, pin the target thread (t->to_thread) to guarantee the target process remains alive. Undelivered transactions without a target thread are already safe, as the target process can only be the current context in those paths.

Back to dashboard
4.0/ 10 priority

Sources & remediation

Other references

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Public PoC and exploit tooling are both present
  • Patch or workaround signal is available
  • 8 mentions across 4 observed days
  • Momentum state: stable

What's happening

  • Exploit tool or code specified in 4 signals
  • PoC mentioned or linked in 6 signals
  • Patch or workaround mentioned in 3 signals
  • Technical details provided in 7 signals
  • Peaked at 3 mentions on most recent observed day (2026-09-06)
  • 8 total mentions across 4 days

Deep dive

Activity timeline8 mentions / 4d
01223Mentions · 2026-07-26: 2Mentions · 2026-09-04: 1Mentions · 2026-09-05: 2Mentions · 2026-09-06: 3PoC Mentioned / Linked · 2026-09-04: 1PoC Mentioned / Linked · 2026-09-05: 2PoC Mentioned / Linked · 2026-09-06: 3Exploit Tool / Code · 2026-09-04: 1Exploit Tool / Code · 2026-09-05: 2Exploit Tool / Code · 2026-09-06: 1Patch / Workaround · 2026-07-26: 2Patch / Workaround · 2026-09-05: 1Technical Details · 2026-07-26: 2Technical Details · 2026-09-04: 1Technical Details · 2026-09-05: 1Technical Details · 2026-09-06: 307-2609-0409-0509-06
Signal classification4 categories
PoC
450.0%
Patch
225.0%
Exploit
112.5%
Disclosure
112.5%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-07-262
Patch2
2026-09-041
PoC1
2026-09-052
Exploit1PoC1
2026-09-063
Disclosure1PoC2
Full discourse8 posts
  • Alejandro Ramos@aramosf
    PoC

    🐧 New: LPE PoC + x86_64 LPE for CVE-2026-64468 — a use-after-free in Linux Binder's binder_free_transaction(). Full credit to Alice Ryhl (Google) for finding & reporting it, and Carlos Llamas for the fix. 🙏 Repo → https://github.com/aramosf/CVE-2026-64468

    Post summary

    The post announces a LPE Proof of Concept for CVE‑2026‑64468, provides a GitHub repository for the PoC, details a use‑after‑free bug in Linux Binder, and gives credit for the fix—no evidence of active exploitation or patch details is given.

    1271103739.8K
    11.5K followersView on X
  • Mr.Niko@_MrNiko
    PoC

    🚨 CVE-2026-64468 Linux Binder UAF in binder_free_transaction() unprivileged race → kmalloc reclaim → root on x86_64 found by Alice Ryhl, fixed by Carlos Llamas (Google) PoC + full LPE with lab GIF: https://github.com/aramosf/CVE-2026-64468 #VulnerabilityResearch #ExploitDev #InfoSec https://t.co/jQ32oWz1Vp

    Post summary

    CVE-2026-64468 is a Linux Binder use‑after‑free that allows unprivileged users to gain root on x86_64; a PoC and full exploit are linked, but no active exploitation or patch details are reported.

    06171303.8K
    1.5K followersView on X
  • Jλckλι@J4ck3LSyN
    PoC

    https://github.com/aramosf/CVE-2026-64468 #CyberSecurity #InfoSec #uaf #lpe

    Post summary

    A public GitHub repository is referenced, implying that a proof‑of‑concept for CVE‑2026‑64468 is available, with no additional context on exploitation or mitigation.

    46023141.9K
    443 followersView on X
  • Rıdvan Yağlı@ridvanyagli
    Exploit

    🔴 Linux Kernel'deki CVE-2026-64468 Binder Use-After-Free açığı için PoC ve x86_64 LPE exploit'i yayınlandı. Bu açık upstream kernel'de yamalandı. Açık, binder_free_transaction() içerisindeki bir process-lifetime Use-After-Free'dan kaynaklanıyor. Yayınlanan exploit, herhangi bir capability veya namespace gerektirmeden yerel, yetkisiz bir kullanıcıdan root (UID 0) yetkisine yükselmeyi gösteriyor. Exploit'in upstream 7.2.0-rc1+ kernel üzerinde çalıştığı ve 6 denemeden 2'sinde root elde edildiği belirtiliyor. Not: Genel amaçlı Linux dağıtımlarında Binder'ın unprivileged kullanıcılara varsayılan olarak açık olmaması nedeniyle etki doğrudan tüm Linux sistemleri için geçerli değil. Android tarafında ise Binder erişilebilir olduğundan açık daha kritik. https://github.com/aramosf/CVE-2026-64468

    Post summary

    The post discloses that a PoC and working LPE exploit for CVE‑2026‑64468 have been published, demonstrates root gains on 7.2.0‑rc1+, and notes the vulnerability has already been patched upstream.

    0201381.2K
    2.4K followersView on X
  • pd/f/@bitcoin180
    PoC

    @aramosf CVE-2026-64468 is a real Binder UAF, but the exploit scope could be clearer. The PoC shows LPE on the tested x86_64 kernel, not every Linux distro or Android/vendor kernel. Please specify the affected configurations to avoid overstating the impact.

    Post summary

    The post confirms CVE-2026-64468 is a true Binder use‑after‑free, with a PoC demonstrating local privilege escalation on x86_64 kernels, but the exploitation scope is limited and further configuration details are requested.

    10040284
    43 followersView on X
  • CVE@CVEnew
    Patch

    CVE-2026-64468 In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF in binder_free_transaction() In binder_free_transaction(), the t->to_proc is rea… https://www.cve.org/CVERecord?id=CVE-2026-64468

    Post summary

    CVE-2026-64468, a kernel Use‑After‑Free bug, has been fixed in the Linux kernel; no exploit or PoC is referenced, and no active exploitation is reported.

    00001804
    57.8K followersView on X
  • pd/f/@bitcoin180
    Disclosure

    CVE-2026-64468 is a real Binder UAF, but the exploit scope could be clearer. The PoC shows LPE on the tested x86_64 kernel, not every Linux distro or Android/vendor kernel. Please specify the affected configurations to avoid overstating the impact.

    Post summary

    CVE-2026-64468 is a confirmed Binder UAF vulnerability causing LPE on x86_64 kernels; the PoC’s scope is limited, and affected configurations need clarification.

    00000109
    24 followersView on X
  • Infoflowcloud@infoflowcloud
    Patch

    🚨*CVE* CVE-2026-64468 In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF in binder_free_transaction() In binder_free_transaction(), the t->to_proc is rea… https://www.cve.org/CVERecord?id=CVE-2026-64468 ----- Traducción: CVE-2026-64468 En … http://infoflow.cloud`

    Post summary

    The message announces that CVE-2026-64468, a use‑after‑free bug in the Linux kernel binder, has been fixed. No PoC, exploit, or active exploitation claims are present.

    0000027
    95 followersView on X

Explore more

Back to dashboard