In the Linux kernel, pending increment operations on binder nodes that are scheduled as deferred work are dropped when a thread exits, because the cancellation routines were no-ops. The lost reference count causes the node’s delivery state and count state to become desynchronized. As a result, userspace never receives the notification required to free the node, and the node remains pinned in the process’s node tree once all external references are released. This limitation can allow an attacker to induce a memory or resource leak that ultimately leads to service degradation or failure.

All Linux kernel builds that contain the vulnerable implementation of the binder subsystem are affected. The specific affected configuration is not enumerated in the advisory; therefore, any unpatched kernel that includes the binder code path described above remains at risk.

The CVSS score is 3.3, indicating low severity. The EPSS score is <1%, suggesting very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation requires local interaction with the binder subsystem, likely achievable by a user with sufficient privileges to create binder nodes. The attacker could repeatedly trigger the scenario to retain nodes indefinitely, thereby exhausting system resources. The primary attack vector is therefore local execution through binder operations, and the impact manifests as a denial of service by leaking kernel memory or resources.