A use‑after‑free condition exists in the Linux kernel’s binderfs device registration routine. During binder device creation, the kernel publishes the new device inode, releases the parent directory lock, and then removes its own reference to the inode. If, before the registration function completes, a concurrent unlink operation removes the device file, the inode is freed. The subsequent call to binder_add_device then writes to this already freed memory region, corrupting kernel data structures and potentially leading to a crash or arbitrary kernel memory write. This flaw represents a classic UAF write (CWE‑416) compounded by a race condition.

All Linux kernel releases compiled before the commit that introduced the UAF fix (30d15f44a9e5…) are considered vulnerable. This conclusion is inferred from the absence of explicit version ranges in the CVE entry, but the presence of the fix commit hash indicates that any earlier kernel versions lack the protective change.

The likely attack vector is a race condition between binderfs file creation and unlink, requiring a local privileged process. The vulnerability is not listed in CISA KEV and has an EPSS score of < 1%, indicating a very low exploitation probability. With a CVSS score of 4.7, the risk is moderate, but the potential to corrupt kernel memory still poses a risk of privilege escalation on the affected system.