In the Linux kernel, the binder driver miscalculates the buffer limit for transactions that involve security contexts. The issue stems from clearing the context size before the buffer size is finalized, causing the end of the buffer to be inflated. This miscalculation allows a copy operation to overflow into memory that stores the security context, leading to memory corruption. If an attacker can trigger binder transactions—such as by sending crafted IPC messages—they may overwrite protected kernel memory, crash the system, or potentially acquire elevated privileges.

All Linux kernels that include the binder driver and have not yet applied the official commit that restores the correctly cached context size. The vulnerability applies to the standard Linux:Linux kernel release; any kernel version before the fix is potentially vulnerable.

The vulnerability has a CVSS score of 7.8, indicating high severity, and is a buffer bound error, making exploitation straightforward for a local attacker who can manipulate binder transactions. The advisory lists an EPSS score of < 1%, indicating a very low exploitation probability, and KEV is not listed. The primary attack vector is local, requiring the ability to send specially crafted binder IPC messages to a target process that uses the txn_security_ctx node. As the kernel memory layout may vary, this attack would likely require trial and error to achieve specific outcomes such as privilege escalation or denial of service.