# CVE-2026-98776: binderfs: fix UAF write in binder_add_device

> A use-after-free vulnerability in the Linux kernel binderfs allows local attackers to achieve code execution or privilege escalation via race conditions.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 18 Oct 2026
- **Updated:** 19 Oct 2026
- **Also known as:** DEBIAN-CVE-2026-98776, GHSA-72x3-g5cv-hfvj, UBUNTU-CVE-2026-98776

## What is CVE-2026-98776?

CVE-2026-98776 is an use after free vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

binderfs: fix UAF write in binder_add_device

binderfs_binder_device_create() publishes the new dentry with
d_make_persistent() and then calls simple_done_creating(), which drops
the parent directory lock and the creator's dentry reference. It then
calls binder_add_device() to register the device in the global
binder_devices list.

After simple_done_creating() releases the parent directory lock, a
concurrent unlinkat() can remove the new device entry. Dropping the
creator's dentry reference can then trigger binderfs_evict_inode(),
freeing the device. binder_add_device() later accesses the freed
object, causing UAF write.

Found by a modified Syzkaller:

	BUG: KASAN: slab-use-after-free in hlist_add_head include/linux/list.h:1073 [inline]
	BUG: KASAN: slab-use-after-free in binder_add_device+0xa9/0xc0 drivers/android/binder.c:7068
	Write of size 8 at addr ffff88805b340c00 by task syz.1.532/11389

	CPU: 0 UID: 0 PID: 11389 Comm: syz.1.532 Not tainted 7.2.0 #4 PREEMPT(full)
	Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
	Call Trace:
	<TASK>
	__dump_stack lib/dump_stack.c:94 [inline]
	dump_stack_lvl+0x10e/0x1f0 lib/dump_stack.c:120
	print_address_description mm/kasan/report.c:378 [inline]
	print_report+0xf7/0x600 mm/kasan/report.c:482
	kasan_report+0xe4/0x120 mm/kasan/report.c:595
	hlist_add_head include/linux/list.h:1073 [inline]
	binder_add_device+0xa9/0xc0 drivers/android/binder.c:7068
	binderfs_binder_device_create.isra.0+0x724/0x990 drivers/android/binderfs.c:196
	binder_ctl_ioctl+0x186/0x1b0 drivers/android/binderfs.c:241
	vfs_ioctl fs/ioctl.c:51 [inline]
	__do_sys_ioctl fs/ioctl.c:597 [inline]
	__se_sys_ioctl fs/ioctl.c:583 [inline]
	__x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583
	do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
	do_syscall_64+0x116/0x800 arch/x86/entry/syscall_64.c:94
	entry_SYSCALL_64_after_hwframe+0x77/0x7f
	RIP: 0033:0x7ff9027a833d
	Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
	RSP: 002b:00007ff903674018 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
	RAX: ffffffffffffffda RBX: 00007ff902a35fa0 RCX: 00007ff9027a833d
	RDX: 0000200000000500 RSI: 00000000c1086201 RDI: 0000000000000004
	RBP: 00007ff902850733 R08: 0000000000000000 R09: 0000000000000000
	R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
	R13: 00007ff902a36038 R14: 00007ff902a35fa0 R15: 00007ffd7166bfa0
	</TASK>

	Allocated by task 11389:
	kasan_save_stack+0x33/0x60 mm/kasan/common.c:57
	kasan_save_track+0x14/0x30 mm/kasan/common.c:78
	poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
	__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415
	kasan_kmalloc include/linux/kasan.h:263 [inline]
	__kmalloc_cache_noprof+0x2e4/0x6f0 mm/slub.c:5489
	_kmalloc_noprof include/linux/slab.h:988 [inline]
	_kzalloc_noprof include/linux/slab.h:1309 [inline]
	binderfs_binder_device_create.isra.0+0x17a/0x990 drivers/android/binderfs.c:148
	binder_ctl_ioctl+0x186/0x1b0 drivers/android/binderfs.c:241
	vfs_ioctl fs/ioctl.c:51 [inline]
	__do_sys_ioctl fs/ioctl.c:597 [inline]
	__se_sys_ioctl fs/ioctl.c:583 [inline]
	__x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583
	do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
	do_syscall_64+0x116/0x800 arch/x86/entry/syscall_64.c:94
	entry_SYSCALL_64_after_hwframe+0x77/0x7f

	Freed by task 11389:
	kasan_save_stack+0x33/0x60 mm/kasan/common.c:57
	kasan_save_track+0x14/0x30 mm/kasan/common.c:78
	kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:584
	poison_slab_object mm/kasan/common.c:253 [inline]
	__kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285
	kasan_slab_free include/linux/kasan.h:235 [inline]
	slab_free_hook mm/slub.c:2677 [inline]
	slab_free mm/slub.c:6377 [inline]
	kfree+0x2fc/0x6e0 mm/slub.c:6692
	binderf
---truncated---

## Which versions are affected by CVE-2026-98776?


## How do I fix CVE-2026-98776?

Apply the vendor's patch.

## Is CVE-2026-98776 being exploited?

There is no known exploitation of CVE-2026-98776 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-98776 and fix it if it is affected.

What it is: CVE-2026-98776 is an use after free vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-98776 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-98776/ (Markdown: https://insights.sbomify.com/CVE-2026-98776/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-98776
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-98776
- OSV: https://osv.dev/vulnerability/CVE-2026-98776

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-98776/
Summaries are generated and may contain mistakes; the official description above is the record.