Description
In binder_transaction of binder.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-136210786References: Upstream kernel
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Android | Android kernel | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 5.2.6-1 | — |
| Debian 13 | linux | 5.2.6-1 | — |
| Debian 12 | linux | 5.2.6-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | linux-aws-5.0 | 5.0.0-1023.26~18.04.1 | USN-4226-1 |
| Ubuntu 18.04 LTS | linux-azure | 5.0.0-1028.30~18.04.1 | USN-4226-1 |
| Ubuntu 18.04 LTS | linux-gcp | 5.0.0-1028.29~18.04.1 | — |
| Ubuntu 18.04 LTS | linux-gcp-edge +2 | No fix yet | — |
| Ubuntu 18.04 LTS | linux-gke-5.0 | 5.0.0-1027.28~18.04.1 | USN-4226-1 |
| Ubuntu 18.04 LTS | linux-hwe | 5.3.0-26.28~18.04.1 | — |
| Ubuntu 18.04 LTS | linux-oem-osp1 | 5.0.0-1033.38 | USN-4226-1 |
| Ubuntu 18.04 LTS | linux-oracle-5.0 | 5.0.0-1009.14~18.04.1 | USN-4226-1 |
Advisories 1
- USN-4226-1 linux, linux-aws, linux-aws-5.0, linux-azure, linux-gcp, linux-gke-5.0, linux-kvm, linux-oem-osp1, linux-oracle, linux-oracle-5.0, linux-raspi2 vulnerabilities Ubuntu Security Notices (USN) · Sep 9, 2026