Thread Exit Vulnerability in Linux Kernel Affects Resource Management

CVE-2026-99075

What is CVE-2026-99075?

A resource management vulnerability exists in the Linux kernel when a thread exits via BINDER_THREAD_EXIT. During this process, pending work items are canceled, but if a thread holds a pending node refcount increment, the increment is inadvertently dropped. This results in an unsynchronized delivery state and count state of the node, leading to userspace not receiving the appropriate notifications. Consequently, the node may remain in the process's node tree unnecessarily when all external references are dropped. This vulnerability has been addressed by implementing a mechanism in DeliverToRead::cancel() for Node and NodeWrapper, allowing the pending refcount update to be appropriately processed on thread exit.

References