The Linux kernel bug causes the binder subsystem to miscalculate the buffer limit for transactions involving security contexts. Because the code clears the context size before the buffer size is finalized, the end of the buffer is inflated by the aligned size of the cleared context. This inflated boundary permits copying data past the allocated memory area, leading to memory corruption. An attacker who can trigger hijacked binder transactions (for example, by sending crafted IPC messages) could potentially overwrite protected kernel memory, crash the system, or gain elevated privileges on the host.

All Linux kernels that include the binder driver and have not yet applied the authoritative commit that restores the correctly cached context size. The issue applies to the common Linux:Linux kernel release; no specific version string is provided in the advisory, so any kernel before the fix is potentially vulnerable.

The vulnerability is a buffer bound error, making exploitation straightforward for a local attacker who can manipulate binder transactions. The advisory does not list an EPSS score or KEV status; therefore its public exploitation risk is uncertain, but the nature of the bug suggests that if exploited, control over kernel memory is possible. The primary attack vector is local, requiring the ability to send specially crafted binder IPC messages to a target process that uses the txn_security_ctx node. As the kernel memory layout may vary, this attack would likely require trial and error to achieve specific outcomes such as privilege escalation or denial of service.