CVE-2026-68458

A flaw was found in the Linux kernel's binder component. An error in calculating buffer boundaries during transaction processing causes a security context's length to be prematurely cleared, leading to an inflated buffer size. This allows data to be written into an unintended memory region, which could result in memory corruption. A local attacker could potentially leverage this to gain unauthorized access to sensitive information or escalate privileges.

This vulnerability is rated as Moderate severity due to the local access required and the potential for kernel memory corruption or privilege escalation through Binder IPC. Red Hat Enterprise Linux releases are not affected because the vulnerable code introduced in upstream kernels is not present in supported versions. Additionally, the Android Binder subsystem is not enabled in standard Red Hat Enterprise Linux kernel builds.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.