In the Linux kernel binder subsystem, the function binder_thread_release() walks a transaction stack after a thread exits but can access a transaction that has already been freed if its t->to_proc pointer has been cleared. A parallel process that kills the transaction and frees it can trigger a use‑after‑free during the walk. The race can corrupt kernel data, crash the system, or, if an attacker can control the timing, result in local privilege escalation. The vulnerability is a classic kernel‑level use‑after‑free weakness as identified in the provided CWEs.

All Linux kernel releases that contain the binder subsystem before the patch commit that adds locking around binder_free_transaction are vulnerable. The CPE string cpe:2.3:o:linux:linux_kernel indicates the entire Linux kernel. No vendor‑specific variants are listed beyond the generic Linux entry, so any system running an affected kernel version is at risk.

The CVSS score of 7.8 describes a significant but not critical impact, and the EPSS score of < 1% shows low likelihood of public exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local privileges, precise timing between thread termination and transaction freeing, and careful manipulation of binder IPC interfaces. Successful exploitation could lead to a denial of service or privilege escalation. The provided patch serializes the relevant accesses with a lock, eliminating the race and effectively removing the vulnerability.