7.8
HIGH CVSS 3.1
CVE-2026-68458
binder: cache secctx size before release zeroes it
Description

In the Linux kernel, the following vulnerability has been resolved: binder: cache secctx size before release zeroes it binder_transaction() bounds the scatter-gather buffer area with sg_buf_end_offset and subtracts the aligned LSM context size because the secctx is written at the tail of that area. The subtraction reads lsmctx.len, but that field has already been cleared by the time the line runs: security_secid_to_secctx(secid, &lsmctx) /* lsmctx.len set */ lsmctx_aligned_size = ALIGN(lsmctx.len, sizeof(u64)) extra_buffers_size += lsmctx_aligned_size ... security_release_secctx(&lsmctx) /* memset zeroes len */ ... sg_buf_end_offset = sg_buf_offset + extra_buffers_size - ALIGN(lsmctx.len, sizeof(u64)) /* ALIGN(0,8) */ security_release_secctx() does memset(cp, 0, sizeof(*cp)), so lsmctx.len reads back as 0 and the subtraction contributes nothing, leaving sg_buf_end_offset too large by the aligned secctx size on every transaction to a txn_security_ctx node. Each BINDER_TYPE_PTR object then derives buf_left = sg_buf_end_offset - sg_buf_offset as the sole upper bound on its copy, so the inflated end offset lets the copy run into the bytes that already hold the secctx. The aligned size must therefore be cached before release rather than re-read from the now-cleared field. Fix by caching it in lsmctx_aligned_size at function scope when it is first computed and subtracting lsmctx_aligned_size instead of re-reading lsmctx.len after release. Reuse the same value for the earlier buf_offset computation.

INFO

Published Date :

Aug. 15, 2026, 6:18 a.m.

Last Modified :

Aug. 17, 2026, 6:17 a.m.

Remotely Exploit :

No

Source :

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products

The following products are affected by CVE-2026-68458 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Linux linux_kernel
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
Score Version Severity Vector Exploitability Score Impact Score Source
CVSS 3.1 HIGH 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Solution
Cache security context size before clearing it to prevent buffer overflows.
  • Cache the aligned size of the security context.
  • Subtract the cached size in offset calculations.
  • Apply the vendor-provided patch for the Linux kernel.
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2026-68458.

URL Resource
https://git.kernel.org/stable/c/1228926e1e4d605cc74d9e675558982a6f2cf446
https://git.kernel.org/stable/c/4257f45ee1fddd0558e77b62af8bb63fd87b2162
https://git.kernel.org/stable/c/b34826e55aad3520ec813f1f367c11b24b29dc9f
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-68458 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-68458 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-68458 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2026-68458 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Aug. 17, 2026

    Action Type Old Value New Value
    Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6fba89813ccf333d2bc4d5caea04cd5f3c39eb50', 'lessThan': '1228926e1e4d605cc74d9e675558982a6f2cf446', 'versionType': 'git'}, {'status': 'affected', 'version': '6fba89813ccf333d2bc4d5caea04cd5f3c39eb50', 'lessThan': '4257f45ee1fddd0558e77b62af8bb63fd87b2162', 'versionType': 'git'}, {'status': 'affected', 'version': '6fba89813ccf333d2bc4d5caea04cd5f3c39eb50', 'lessThan': 'b34826e55aad3520ec813f1f367c11b24b29dc9f', 'versionType': 'git'}], 'programFiles': ['drivers/android/binder.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.14'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.14', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc3', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/android/binder.c'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6fba89813ccf333d2bc4d5caea04cd5f3c39eb50', 'lessThan': '1228926e1e4d605cc74d9e675558982a6f2cf446', 'versionType': 'git'}, {'status': 'affected', 'version': '6fba89813ccf333d2bc4d5caea04cd5f3c39eb50', 'lessThan': '4257f45ee1fddd0558e77b62af8bb63fd87b2162', 'versionType': 'git'}, {'status': 'affected', 'version': '6fba89813ccf333d2bc4d5caea04cd5f3c39eb50', 'lessThan': 'b34826e55aad3520ec813f1f367c11b24b29dc9f', 'versionType': 'git'}], 'programFiles': ['drivers/android/binder.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.14'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.14', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/android/binder.c'], 'defaultStatus': 'affected'}]
  • New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Aug. 15, 2026

    Action Type Old Value New Value
    Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6fba89813ccf333d2bc4d5caea04cd5f3c39eb50', 'lessThan': '1228926e1e4d605cc74d9e675558982a6f2cf446', 'versionType': 'git'}, {'status': 'affected', 'version': '6fba89813ccf333d2bc4d5caea04cd5f3c39eb50', 'lessThan': '4257f45ee1fddd0558e77b62af8bb63fd87b2162', 'versionType': 'git'}, {'status': 'affected', 'version': '6fba89813ccf333d2bc4d5caea04cd5f3c39eb50', 'lessThan': 'b34826e55aad3520ec813f1f367c11b24b29dc9f', 'versionType': 'git'}], 'programFiles': ['drivers/android/binder.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.14'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.14', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc3', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/android/binder.c'], 'defaultStatus': 'affected'}]
    Added Description In the Linux kernel, the following vulnerability has been resolved: binder: cache secctx size before release zeroes it binder_transaction() bounds the scatter-gather buffer area with sg_buf_end_offset and subtracts the aligned LSM context size because the secctx is written at the tail of that area. The subtraction reads lsmctx.len, but that field has already been cleared by the time the line runs: security_secid_to_secctx(secid, &lsmctx) /* lsmctx.len set */ lsmctx_aligned_size = ALIGN(lsmctx.len, sizeof(u64)) extra_buffers_size += lsmctx_aligned_size ... security_release_secctx(&lsmctx) /* memset zeroes len */ ... sg_buf_end_offset = sg_buf_offset + extra_buffers_size - ALIGN(lsmctx.len, sizeof(u64)) /* ALIGN(0,8) */ security_release_secctx() does memset(cp, 0, sizeof(*cp)), so lsmctx.len reads back as 0 and the subtraction contributes nothing, leaving sg_buf_end_offset too large by the aligned secctx size on every transaction to a txn_security_ctx node. Each BINDER_TYPE_PTR object then derives buf_left = sg_buf_end_offset - sg_buf_offset as the sole upper bound on its copy, so the inflated end offset lets the copy run into the bytes that already hold the secctx. The aligned size must therefore be cached before release rather than re-read from the now-cleared field. Fix by caching it in lsmctx_aligned_size at function scope when it is first computed and subtracting lsmctx_aligned_size instead of re-reading lsmctx.len after release. Reuse the same value for the earlier buf_offset computation.
    Added Reference https://git.kernel.org/stable/c/1228926e1e4d605cc74d9e675558982a6f2cf446
    Added Reference https://git.kernel.org/stable/c/4257f45ee1fddd0558e77b62af8bb63fd87b2162
    Added Reference https://git.kernel.org/stable/c/b34826e55aad3520ec813f1f367c11b24b29dc9f
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.