Linux Kernel CVE-2026-68458

The Linux kernel binder driver (drivers/android/binder.c) implements the Android inter-process communication framework and is optionally available on standard Linux. The vulnerability resides in binder_transaction() during handling of transactions to nodes with the txn_security_ctx flag set. The function calls security_secid_to_secctx() to populate an lsmctx structure - including its .len field - then computes lsmctx_aligned_size = ALIGN(lsmctx.len, sizeof(u64)) and adds it to extra_buffers_size to reserve space for the security context at the tail of the scatter-gather buffer region. The function then calls security_release_secctx(), which performs memset(cp, 0, sizeof(*cp)), zeroing the entire lsmctx struct including .len. The subsequent calculation of sg_buf_end_offset subtracts ALIGN(lsmctx.len, sizeof(u64)) - now ALIGN(0, 8) = 0 - instead of the previously computed aligned size, leaving sg_buf_end_offset inflated by the full aligned secctx size. Each BINDER_TYPE_PTR object in the transaction then derives buf_left from this inflated end offset, permitting scatter-gather copies to reach into the secctx bytes already written at the tail of the buffer. The correct fix, as committed upstream, is to cache lsmctx_aligned_size before calling security_release_secctx() and subtract the cached value rather than re-evaluating the zeroed field. No CWE is formally assigned in the input; the root cause is functionally a stale-read after deliberate struct zeroing, analogous to CWE-908 (use of uninitialized resource) applied to a post-release cleared field.