CVE-2026-68458

In the Linux kernel, the following vulnerability has been resolved: binder: cache secctx size before release zeroes it bindertransaction bounds the scatter-gather buffer area with sgbufendoffset and subtracts the aligned LSM context size because the secctx is written at the tail of that area. The...

CVE-2026-68458 binder: cache secctx size before release zeroes it

In the Linux kernel, the following vulnerability has been resolved: binder: cache secctx size before release zeroes it bindertransaction bounds the scatter-gather buffer area with sgbufendoffset and subtracts the aligned LSM context size because the secctx is written at the tail of that area. The...

CVE-2026-68458

CVE-2026-68458 concerns the Linux kernel binder vulnerability where a miscalculation of the end-of-buffer offset could allow a copy to overrun into a region holding the security context (secctx). The root cause is that sg_buf_end_offset was computed using the value of lsmctx.len after security_re...