In the Linux kernel, the following vulnerability has been resolved:
binder: fix double-free in dbitmap
A process might fail to allocate a new bitmap when trying to expand its proc->dmap. In that case, dbitmap_grow() fails and frees the old bitmap via dbitmap_free(). However, the driver calls dbitmap_free() again when the same process terminates, leading to a double-free error:
================================================================== BUG: KASAN: double-free in binder_proc_dec_tmpref+0x2e0/0x55c Free of addr ffff00000b7c1420 by task kworker/9:1/209
CPU: 9 UID: 0 PID: 209 Comm: kworker/9:1 Not tainted 6.17.0-rc6-dirty #5 PREEMPT Hardware name: linux,dummy-virt (DT) Workqueue: events binder_deferred_func Call trace: kfree+0x164/0x31c binder_proc_dec_tmpref+0x2e0/0x55c binder_deferred_func+0xc24/0x1120 process_one_work+0x520/0xba4 [...]
Allocated by task 448: __kmalloc_noprof+0x178/0x3c0 bitmap_zalloc+0x24/0x30 binder_open+0x14c/0xc10 [...]
Freed by task 449: kfree+0x184/0x31c binder_inc_ref_for_node+0xb44/0xe44 binder_transaction+0x29b4/0x7fbc binder_thread_write+0x1708/0x442c binder_ioctl+0x1b50/0x2900 [...] ==================================================================
Fix this issue by marking proc->map NULL in dbitmap_free().
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Ubuntu | — | Upgrade linux-image-realtime-6.17Upgrade linux-image-genericUpgrade linux-image-aws-6.17Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-generic-64kUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-gcpUpgrade linux-image-realtimeUpgrade linux-image-6.17.0-7-generic-64kUpgrade linux-image-oem-24.04Upgrade linux-image-virtualUpgrade linux-image-virtual-6.17Upgrade linux-image-raspi-6.17Upgrade linux-image-aws-64kUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-gcp-64kUpgrade linux-image-aws-64k-6.17Upgrade linux-image-generic-6.17Upgrade linux-image-oem-24.04cUpgrade linux-image-6.17.0-1004-aws-64kUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.17.0-1005-raspiUpgrade linux-image-6.17.0-1004-gcpUpgrade linux-image-gcp-6.17Upgrade linux-image-6.17.0-1003-realtimeUpgrade linux-image-gcp-64k-6.17Upgrade linux-image-6.17.0-7-genericUpgrade linux-image-awsUpgrade linux-image-raspiUpgrade linux-image-generic-64k-6.17Upgrade linux-image-6.17.0-1004-awsUpgrade linux-image-6.17.0-1004-gcp-64k | Dec 5, 2025 | Dec 3, 2025 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub