The vulnerability arises in the Linux kernel binder subsystem, where a use‑after‑free occurs in binder_netlink_report() after a pending frozen transaction error. The code dereferences a transaction structure that may have already been freed, leading to a memory corruption that triggers a KASAN report and can crash the kernel, resulting in a denial of service for the host system. This flaw is identified as a classic CWE‑416 use‑after‑free bug.

Affected system: Linux kernel. All shipped kernel releases that include the binder subsystem and match kernel versions 6.19 rc1 through rc8, as enumerated by the provided CPE identifiers. Systems running any unsupported or older 6.19 release before the rc9 revision are vulnerable; later stable releases (6.19 onwards) where the patch has been applied are safe.

The CVSS score of 7.8 denotes high severity. The EPSS score of less than 1 % indicates a low probability of exploitation as of the latest data, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is local access to the binder interface, for example through user‑level binder tools or applications that initiate one‑way transactions to frozen targets, which could trigger the crash. Because the impact is a kernel crash, the risk is significant for exposed services. Applying the available kernel update mitigates the issue entirely.