The reported flaw occurs in the Linux kernel’s binder subsystem where deferred work items are not cleared during thread termination. When a thread exits while an outgoing binder transaction remains active, the pending work items are left allocated. Subsequent attempts to process or cancel these stale items can reference resources that have already been released, triggering a kernel crash and a system reboot. This is a classic instance of improper resource cleanup that compromises availability, and depending on the exploit path could potentially affect confidentiality or integrity as well.

The defect is present in all releases of the Linux kernel that have not yet incorporated the commit sequence found in the provided git links. The affected binaries are those built from kernel source without the fix that cleans up deferred binder work items in the Thread::release() path. In practice, any kernel version prior to the incorporation of those patches—including mainstream distributions still using older kernel trees—remains vulnerable.

CVSS score is 3.3, indicating low severity. The EPSS score is < 1%, reflecting a very low probability that the vulnerability is being actively exploited in the wild. The vulnerability is not listed in the CISA KEV catalog. However, a local or escalated user could trigger the race condition by terminating a thread that has an active binder transaction, leading to a kernel panic. The risk is still significant as the crash leads to a complete loss of availability for the affected host, and the lack of automatic mitigation path means that exploitation would require no additional privileges beyond the ability to kill the target thread.