The bug in the Linux kernel’s binder module caused the spam‑detection logic for TreeRange to run before a new request was inserted into the tracking tree, so the new request was omitted from the spam calculation. In addition, ArrayRange lacked spam detection entirely, allowing high‑volume “spamming” transactions to bypass safeguards and potentially exhaust kernel resources, thereby degrading system performance. This flaw is a resource‑consumption issue, indexed as CWE-770, and can lead to a denial‑of‑service condition. The likely attack vector is local processes generating large numbers of binder requests, as the problem depends on traffic from binder clients rather than external network input, a conclusion inferred from the description.

All Linux kernel releases that contain the binder module and have not yet applied the referenced commits (4fc87c240b8f30e22b7ebaae29d57105589e1c0b, 8d34c993a9a156e657e43cb95186980745cc3597, or edf685946c4acbe57cb96f8d5f3c07e9a2e973c8) are vulnerable. Kernels newer than these commits are considered safe.

Exploitation requires the ability to generate binder requests, normally through processes that interact with the binder service. The vulnerability has no documented remote vector; it is likely that unprivileged local processes could generate high‑volume traffic to trigger a denial‑of‑service by exhausting CPU or memory. The EPSS score (<1%) indicates a very low probability of exploitation, and the issue is not listed in the CISA KEV catalog. The likely attack vector is local binder traffic, as the flaw depends on the volume of requests sent by binder clients, a conclusion inferred from the described bug. Because the attack surface is limited to binder range handling, the potential for service degradation remains significant, warranting prompt remediation.