In the Linux kernel, pending increment operations on binder nodes that are scheduled as deferred work are dropped when a thread exits, because the cancellation routines were no-ops. The lost reference count causes the node’s delivery state and count state to become desynchronized. As a result, userspace never receives the notification required to free the node, and the node remains pinned in the process’s node tree once all external references are released. This limitation can allow an attacker to induce a memory or resource leak that ultimately leads to service degradation or failure.

All Linux kernel builds that contain the vulnerable implementation of the binder subsystem are affected. The specific affected configuration is not enumerated in the advisory; therefore, any unpatched kernel that includes the binder code path described above remains at risk.

No CVSS score is provided, and the EPSS score is unavailable, which suggests that the risk has not yet been quantified publicly. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation requires interaction with the binder subsystem, likely achievable by a local user with sufficient privileges to create binder nodes. The attacker could repeatedly trigger the scenario to retain nodes indefinitely, thereby exhausting system resources. The primary attack vector is therefore local execution through binder operations, and the impact manifests as a denial of service by leaking kernel memory or resources.