CVE-2026-98777

A flaw was found in the Linux kernel's Android Binder inter-process communication (IPC) driver. When an asynchronous transaction supersedes an earlier pending transaction in a frozen process, the kernel frees the outdated transaction without releasing associated file descriptor references. A local user can exploit this vulnerability to persistently leak file objects in kernel memory, ultimately leading to a denial of service (DoS) through system resource exhaustion.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.