A missing cleanup call in the Linux kernel’s binder driver caused all fd fixup entries to be leaked whenever a pending async transaction was superseded by a TF_UPDATE_TXN transaction in a frozen process. The leak keeps the referenced struct file objects pinned in memory, preventing their file reference counts from reaching zero. As a result, the file descriptors never close, causing the system to accumulate leaked file objects across process exits until the global file reference limit is exhausted. This creates a denial‑of‑service condition and can lead to broader kernel instability because the leaked resources consume memory and file descriptor table entries.

The flaw exists in the Linux kernel binder subsystem. The exact affected kernel versions are not listed in the CNA data, but the bug was addressed in the commit referenced in the advisory links, indicating that any pre‑patch kernel build is vulnerable. The issue applies to all distributions that ship the affected kernel without applying the patch, regardless of vendor or distribution. The failure is triggered by any binder client that issues a TF_UPDATE_TXN transaction that supersedes a pending async transaction in a frozen process.

While the vulnerability does not provide an easy code‑execution path, it is a local resource exhaustion vector that can be triggered by applications using the binder IPC mechanism, with a CVSS score of 3.3 indicating low severity. Because the exploit requires interaction with the binder subsystem, the attack is limited to systems that expose binder to user processes, typically in Android or custom Linux environments. The EPSS score is 0.00168, indicating a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog, suggesting that public exploitation data is limited. Nevertheless, the high impact of exhausting file descriptors and the lack of a mitigation aside from patching make the risk significant for systems that rely heavily on binder transactions.