{"id":"AZL-109454","summary":"CVE-2026-98778 affecting package kernel 6.6.157.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nbinder: fix is_failure flag for superseded transaction cleanup\n\nWhen a TF_UPDATE_TXN transaction supersedes a pending async transaction,\nbinder_release_entire_buffer() is called with is_failure=false. Since the\nsuperseded transaction was never delivered, binder_apply_fd_fixups() was\nnever called and no fds were installed in the target process.\n\nWith is_failure=false, the BINDER_TYPE_FDA cleanup handler interprets\nstale buffer contents as installed fd numbers and passes them to\nbinder_deferred_fd_close(), closing unrelated file descriptors.\n\nPass is_failure=true since the transaction was never delivered to the\ntarget, matching the semantics of all other undelivered-transaction\ncleanup paths.","modified":"2026-10-19T14:16:50.176250947Z","published":"2026-10-18T16:17:31Z","upstream":["CVE-2026-98778"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98778"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.157.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-109454.json"}}],"schema_version":"1.9.0"}