CVE-2026-23184: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-23184 is a use-after-free (UAF) vulnerability in the Linux kernel's binder subsystem, specifically in the binder_netlink_report() function. When oneway transactions are sent to frozen targets via binder_proc_transaction(), the kernel returns a BR_TRANSACTION_PENDING_FROZEN error but still treats the transaction as successful. The binder_netlink_report() function then dereferences the transaction pointer t after this error, at which point the transaction may have already been freed by the now-thawed target — resulting in a heap use-after-free condition. Affected versions include Linux kernel 6.18.0 through 6.18.9 and 6.19-rc1 through 6.19-rc8. The vulnerability carries a CVSS v3.1 base score of 7.8 (High) (Feedly, Kernel Patch).

The root cause is classified as CWE-416 (Use After Free). In binder_proc_transaction(), oneway transactions targeting frozen processes return BR_TRANSACTION_PENDING_FROZEN but are not aborted — the transaction object t remains live from the caller's perspective. However, once the frozen target thaws, it can consume and free the transaction. binder_netlink_report() subsequently dereferences t without accounting for this race, leading to a slab-use-after-free as confirmed by a KASAN report showing a read of 8 bytes at a freed heap address. The attack vector is local (AV:L), requires low privileges (PR:L), and no user interaction. The fix implements a transaction copy in binder_netlink_report() to safely access transaction data after a pending frozen error (Feedly, Kernel Patch).

Successful exploitation can result in kernel heap memory corruption, potentially leading to a kernel crash (denial of service), information disclosure of kernel memory contents, or local privilege escalation to root. The KASAN report confirms heap use-after-free with a read at a freed slab address, indicating the potential for controlled memory corruption. Because the vulnerability resides in the kernel binder IPC subsystem — widely used on Android and Linux systems — exploitation could affect the stability and security of the entire host (Feedly).

No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is 0.018% (0.000180), reflecting a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with low privileges, limiting the attack surface compared to remotely exploitable vulnerabilities (Feedly).

• Logs: Kernel logs (dmesg or /var/log/kern.log) containing KASAN reports referencing binder_netlink_report.isra.0 with slab-use-after-free errors.
• Logs: Stack traces involving binder_transaction, binder_thread_write, or binder_ioctl in kernel crash or KASAN output.
• Process: Unexpected crashes or restarts of processes using the binder IPC interface (e.g., Android services or binder-util).
• System: Kernel panics or oops messages on systems running Linux kernel 6.18.0–6.18.9 or 6.19-rc1–6.19-rc8 involving binder subsystem calls.

Update the Linux kernel to version 6.18.10 or later for systems on the 6.18 branch; systems running 6.19-rc releases should apply the upstream fix commits (Kernel Patch, Kernel Patch 2). As a short-term workaround, restrict local access to vulnerable systems to trusted users only, since exploitation requires low-privilege local access. Monitor kernel logs for KASAN warnings or binder-related crashes as an indicator of attempted exploitation.

The vulnerability was noted on Mastodon via VulDB (VulDB Mastodon) and tracked by Tenable's Nessus scanner (plugin 299093). No significant vendor statements or notable researcher commentary beyond standard vulnerability tracking have been observed (Feedly).