CVE-2026-98774 PUBLISHED

rust_binder: cancel deferred work items in thread exit

Assigner: Linux
Reserved: 25.09.2026 Published: 18.10.2026 Updated: 18.10.2026

In the Linux kernel, the following vulnerability has been resolved:

rust_binder: cancel deferred work items in thread exit

If there are deferred work items on the thread todo list, then they are not cleaned up in the Thread::release() method. Thus, update the code to clean up the work items even if they are deferred.

This can happen if the thread dies while it has an active outgoing transaction.

Product Status

Vendor Linux
Product Linux
Versions Default: unaffected
  • affected from eafedbc7c050c44744fbdf80bdf3315e860b7513 to d54df2de22f9ac5b660d0ec898986f805e97c096 (excl.)
  • affected from eafedbc7c050c44744fbdf80bdf3315e860b7513 to 98dc9fababd1b7fb1a88b8362183baa5779c2394 (excl.)
  • affected from eafedbc7c050c44744fbdf80bdf3315e860b7513 to 62479b6e5df82cbdf3c4145130928f233fae78fb (excl.)
Vendor Linux
Product Linux
Versions Default: affected
  • Version 6.18 is affected
  • unaffected from 0 to 6.18 (excl.)
  • unaffected from 6.18.56 to 6.18.* (incl.)
  • unaffected from 7.2.10 to 7.2.* (incl.)
  • unaffected from 7.3-rc6 to * (incl.)

References