The Linux kernel binder subsystem had a flaw where superseded transactions that never reached the target were marked as a non‑failure. The cleanup handler misinterpreted stale buffer data as file descriptors and closed unrelated file descriptors in the process, leading to service interruptions. This is a misuse of resource cleanup that can cause denial of service by terminating I/O descriptors unexpectedly.

All Linux kernel builds that include the binder driver before the fix were committed to are affected. The impact list lists a generic Linux kernel CPE; no specific version ranges are given.

The CVSS score of 5.5 indicates medium severity. EPSS is less than 1%, implying a low likelihood of exploitation, and the vulnerability is not in the CISA KEV catalog. The likely attack vector is a local attacker able to write to the binder IPC interface. Since the flaw occurs when a TF_UPDATE_TXN transaction supersedes a pending async transaction, an attacker can trigger the bug by sending crafted binder messages. This can wipe legitimate file descriptors, causing legitimate services to fail, but requires access to the binder interface.